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Is  There  a  Nexus  Between  Terrorist 
Involvement  and  Mental  Health  in  the  Age 
of  the  Islamic  State? 

By  Emily  Comer  and  Paul  Gill 


The  wave  of  Islamic  State-linked  terrorism  experienced  in 
the  West  over  the  past  couple  ofyears  has  rekindled  debates 
surrounding  mental  disorders  and  terrorist  engagement. 
A  very  preliminary  survey  by  the  authors  found  that  out  of 
55  attacks  in  the  West  where  the  76  individuals  involved 
were  possibly  influenced  by  the  Islamic  State,  according 
to  media  reports,  27.6%  had  a  history  of  apparent 
psychological  instability,  a  percentage  comparable  to  that 
found  in  the  general  population.  This  figure  is  driven  largely 
by  individuals  inspired  by  the  Islamic  State,  as  opposed 
to  those  directed  by  it,  however.  The  percentage  is  likely 
overinflated  for  several  noteworthy  reasons,  including 
poor  reporting,  low  benchmarks,  and  the  tendency 
to  overuse  mental  health  problems  as  a  ‘silver-bullet’ 
explanation  for  terrorist  involvement.  The  relationship 
is,  in  fact,  far  more  complex  than  typically  presented. 


The  Islamic  State-linked  terrorism  experienced  in  the 
West  recently  has  reignited  debates  about  the  con¬ 
nection  between  mental  disorders  in  terrorist  activ¬ 
ity.  Indeed,  the  assistant  commissioner  for  specialist 
operations  in  London’s  Metropolitan  Police  Service 
acknowledges  the  Islamic  State  is  actively  trying  to  recruit,  among 
others,  “those  with  mental  health  issues.”1  Similarly,  Australia’s  na¬ 
tional  counterterrorism  coordinator,  Greg  Moriarty,  has  outlined 
that  many  cases  involve  individuals  “not  necessarily  deeply  com¬ 
mitted  to  and  engaged  with  the  Islamist  ideology  but  are  none¬ 
theless,  due  to  a  range  of  reasons,  including  mental  health  issues, 
susceptible  to  being  motivated  and  lured  rapidly  down  a  dangerous 
path  by  the  terrorist  narrative.”2  The  debates  became  particularly 
salient  through  the  summer  of  2016  when  lone  actors  inspired  and 
encouraged  by  the  Islamic  State  killed  135  civilians  in  separate  at¬ 
tacks  in  Orlando  and  Nice.  More  recently,  the  fatal  shooting  of  five 
individuals  at  Fort  Lauderdale  airport  added  complexity  to  these 
debates.  All  perpetrators  had  reported  histories  of  mental  disorder. 
This  article  seeks  to  answer  several  questions  to  provide  a  more 


Emily  Comer  is  a  research  associate  at  the  University  College 
London’s  Department  of  Security  and  Crime  Science.  She  is  cur¬ 
rently  working  on  a  European  Union-funded  project  on  lone-actor 
terrorists. 

Paid  Gill  is  a  senior  lecturer  at  the  University  College  London’s 
Department  of  Security  and  Crime  Science.  He  is  currently  work¬ 
ing  on  projects  on  decision-making  and  lone-actor  terrorism  that 
are  fiinded  by  CREST,  the  European  Union,  and  Minerva. 


rigorous  evidence  base  for  these  debates.  These  questions  include: 
What  is  the  existing  evidence  base  regarding  psychopathology  and 
terrorist  involvement?  How  prevalent  are  mental  disorders  among 
Islamic  State-directed  and  -inspired  offenders  in  the  West?  What 
is  the  content  of  these  diagnoses?  When  present,  what  relationship 
did  the  disorder  have  with  radicalization? 

The  Evidence  Base 

Very  few  scientific  analyses  have  focused  upon  the  relationship 
between  mental  health  and  terrorist  involvement.  The  following 
outlines  the  headline  results  from  the  sum  total  of  these  scientific 
endeavors.3  Some  recent  studies  analyzed  the  prevalence  rates  of 
different  disorders  within  very  different  samples  of  terrorist  offend¬ 
ers.  Based  on  police  files,  6%  of  Anton  Weenink’s  sample  of  140 
Dutch  individuals  who  either  became  foreign  fighters  or  sought  to 
travel  abroad  for  the  purpose  of  terrorism  had  diagnosed  disorders.4 
An  additional  20%  displayed  signs  of  undiagnosed  mental  health 
problems.  The  diagnoses  included  ADD,  AD/HD,  autism  spectrum, 
narcissistic,  schizophrenia,  post-traumatic  stress,  and  psychotic  dis¬ 
orders.  The  prevalence  of  schizophrenia  (2%)  in  the  sample  was 
higher  than  what  would  be  expected  in  the  general  population, 
which  is  currently  estimated  at  between  0.87%  and  1%.5 

A  study  of  lone-actor  terrorists  co-authored  by  the  authors  of 
this  article  also  found  higher  rates  of  schizophrenia  than  in  the  gen¬ 
eral  population,  as  well  as  certain  other  disorders.  Based  on  open 
source  information,  over  40%  of  Emily  Corner,  Paul  Gill,  and  Oliver 
Mason’s  study6  of  153  lone-actor,  solo-actor,  and  dyad  terrorists4 
had  a  diagnosed  disorder,  much  higher  than  in  the  general  pop- 


a  A  lone-actor  terrorist  is  defined  by  John  Horgan,  Paul  Gill,  Noemie 
Bouhana,  James  Silver,  and  Emily  Corner  as  “an  individual  lacking  any 
ties  to  a  terrorist/violent  extremist  group  ...  These  individuals  typically 
engage  in  violence  in  support  of  a  group  and/or  ideology."  Lone  actors 
within  the  sample  included  those  inspired  by  Islamist,  right-wing,  left- 
wing,  nationalist,  and  single  issue  ideologies.  John  Horgan,  Paul  Gill, 
Noemie  Bouhana,  James  Silver,  and  Emily  Corner,  “Across  the  universe?  A 
comparative  analysis  of  violent  radicalization  across  three  offender  types 
with  implications  for  criminal  justice  training  and  education,”  National 
Institute  of  Justice,  June  2016.  A  “solo-actor  terrorist"  is  defined  as  "an 
individual  who  either  (a)  carried  out  the  act  of  terror  alone,  but  under 
instruction  or  (b)  carries  out  the  act  through  his/her  own  volition,  but  has 
had  previous  contact  with  terrorist/violent  extremist  groups  and/or  radical 
environments  to  receive  planning  and  support.”  John  Horgan  et  al.  A  dyad 
in  this  context  refers  to  two  individuals  who  conceive,  plan,  and  carry  out 
an  attack  on  their  own.  One  or  both  individuals  may  have  previously  been 
attached  to  a  terrorist  group. 
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ulation  (25-27%).b  The  diagnoses  included  schizophrenia  (8.5%), 
depression  (7-2%),  unspecified  personality  disorder  (6.5%),  bipolar 
disorder  (3.9%),  post-traumatic  stress  disorder  (PTSD,  3.3%),  au¬ 
tism  spectrum  disorder  (3.3%),  delusional  disorder  (2.0%),  unspec¬ 
ified  anxiety  disorder  (1.3%),  traumatic  brain  injury  (TBI,  1.3%), 
obsessive  compulsive  disorder  (OCD,  1.3%),  unspecified  sleep  dis¬ 
order  (0.7%),  schizoaffective  disorder  (0.7%),  psychotic  disorder 
(0.7%),  drug  dependence  (0.7%),  and  dissociative  disorder  (0.7%).c 
Three  disorders  held  a  substantially  higher  prevalence  than  found 
within  general  populations  (schizophrenia,  delusional  disorder,  and 
autism  spectrum  disorders),  whereas  depression,  anxiety,  PTSD, 
and  sleep  disorders  are  more  commonly  found  within  the  general 
population  than  the  lone-actor  sample.7 

Michael  and  Simon  Gottschalk8  also  tested  rates  of  various  mea¬ 
sures  of  personality  and  psychopathology  within  terrorist  samples 
against  the  civilian  population.  By  administering  the  MMPI-2,d 
they  compared  90  incarcerated  Palestinian  and  Israeli  terrorists  to 
control  groups  of  Palestinians  and  Israeli  Jews  matched  on  demo¬ 
graphic  features.  The  former  group  scored  higher  on  subscale  mea¬ 
sures  of  psychopathic  deviate,  paranoid,  depressive,  schizophrenic, 
and  hypomanic  tendencies. 

It  is  worth  remembering,  however,  that  the  Weenink  study  and 
the  Corner,  Gill,  and  Mason  study  are  based  on  small  samples  of 
particular  terrorist  types  and  not  necessarily  a  depiction  of  all  ter¬ 
rorist  populations  globally.  Evidence  suggests,  for  example,  that 
the  rates  of  mental  disorders  within  lone-actor  terrorist  popula¬ 
tions  are  significantly  higher  than  group-based  terrorists.  Corner, 
Gill,  and  Mason9  found  a  negative  correlation  between  the  level  of 
co-offending  and  the  rate  of  mental  disorder  prevalence.  Whereas 
40%  of  the  study’s  lone-actor  terrorists  had  a  mental  disorder,  the 
prevalence  rates  were  lower  for  solo-actor  terrorists  at  around  20%, 
just  over  5%  for  terrorist  dyads,  and  less  than  3%  for  terrorist  group 
members."  In  an  earlier  study,  Corner  and  Gill  found  that  lone-actor 
terrorists  were  13.5  times  more  likely  to  have  a  mental  disorder  than 


b  A  large-scale  worldwide  epidemiological  investigation  based  on  the 
International  Classification  of  Diseases  (ICD)  diagnostic  tool  highlighted 
that  the  average  prevalence  for  a  diagnosis  of  any  disorder  is  27.43%. 
Ronald  Kessler  and  Bedirhan  Ustun,  The  WHO  world  mental  health  surveys: 
Global  perspectives  on  the  epidemiology  of  mental  disorders  (Cambridge: 
Cambridge  University  Press,  2008).  Whereas  a  worldwide  study  utilizing 
the  Diagnostic  and  Statisticians  Manual  (DSM)  as  a  diagnostic  tool 
identified  a  lifetime  prevalence  of  25.0%.  Jordi  Alonso  et  at,  “Prevalence 
of  Mental  Disorders  in  Europe:  Results  from  the  European  Study  of  the 
Epidemiology  of  Mental  Disorders  (ESEMeD)  Project,"  Acta  Psychiatrica 
Scandinavica  109  (2004):  pp.  21-22. 

c  The  cases  were  based  on  information  found  in  open  source  accounts, 
including  court  documents.  Diagnoses  were  confirmed  through  extensive 
cross-checking  of  sources.  Court  decisions  were  deemed  most  reliable,  but 
in  some  cases,  mental  health  status  was  not  argued  at  trial  as  the  individual 
had  an  established  history. 

d  Developed  from  the  MMPI  by  James  Neal  Butcher,  it  is  utilized  by  mental 
health  professionals  to  clinically  assess  personality  traits  and  mental 
health  problems.  James  Neal  Butcher,  “Minnesota  Multiphasic  Personality 
Inventory  (MMPI),  International  Encyclopedia  of  the  Social  &  Behavioral 
Sciences  (1989):  pp.  9,891-9,894. 

e  An  individual  in  a  group  (three  or  more  individuals)  involved  in  or  intent  on 
carrying  out  acts  of  terrorism.  This  database  consists  of  544  actors,  with 
links  to  85  designated  terror  organizations.  (Cross  checked  with  Terrorism 
Research  &  Analysis  Consortium,  Global  Terrorism  Database,  and  the  U.S. 
Department  of  State's  list  of  terrorist  designations  and  state  sponsors  of 
terrorism). 


group-based  terrorists.10  This  result  was  in  line  with  Christopher 
Hewitt’s  analysis  of  U.S.-based  terrorists  who  espoused  a  range  of 
ideologies  (22%  vs.  8.1%), 11  and  that  of  Jeff  Gruenewald,  Steven 
Chermak,  and  Joshua  Freilich,  who  examined  U.S.-based,  far-right 
offenders  (40.4%  vs.  7 .6%). 

Evidence  also  suggests  that  some  terrorist  roles  may  be  more 
likely  to  experience  particular  mental  disorders.  Ariel  Merari 
and  his  colleagues  carried  out  psychological  tests  on  samples  of 
suicide  bombers  and  various  control  groups  (e.g.  other  terrorists 
and  non-political  criminals)12  employing  a  range  of  techniques 
including  clinical  interviews,  personality  tests,  the  Thematic  Ap¬ 
perception  Test,  and  the  House-Tree-Person  Drawing  test.  Suicide 
bombers  obtained  significantly  more  diagnoses  of  Avoidant-De¬ 
pendent  Personality  Disorder  (60%  vs.  17%),  depressive  symptoms 
(53%  vs.  8%)  and  more  readily  displayed  suicidal  tendencies  (40% 
vs.  0%).  On  the  other  hand,  the  control  group  was  more  likely  to 
contain  members  with  psychopathic  tendencies  (25%  vs.  0%)  and 
impulsive-unstable  tendencies  (67%  vs.  27%).  Suicide  bomber  or¬ 
ganizers  scored  higher  in  ego-strength,  impulsivity,  and  emotional 
instability  than  would-be  suicide  bombers. 

Collectively,  these  results  provide  important  insight  into  how  we 
should  try  to  understand  Islamic  State-linked  cases.  We  should  ex¬ 
pect  to  see  higher  rates  of  specific  mental  disorders  among  lone-ac¬ 
tors  than  the  general  population,  and  we  should  expect  variance 
across  the  roles  and  behaviors  that  these  individuals  engage  in  once 
they  have  chosen  to  turn  to  violence  (e.g.  suicide  attack  vs.  non-sui¬ 
cide  attack).  We  may  also  expect  to  find  higher  rates  of  disorders 
among  lone  actors  inspired  and  encouraged  versus  those  who  are 
directly  trained  and  dispatched  by  the  Islamic  State. 

The  Circumstantial  Evidence  Base 

Whereas  the  above  studies  meticulously  collected  data  and  com¬ 
pared  the  terrorist  samples  to  wider  comparison  or  control  groups, 
no  such  studies  exist  on  Islamic  State-linked  plotters  in  the  West. 
Some  insight  may  come  from  a  couple  of  studies  on  al-Qa 'ida-in- 
spired  or  -directed  terrorism  in  the  1990s  and  2000s  to  provide 
a  useful  framework  for  trying  to  understand  the  current  security 
problem.  Marc  Sageman’s  seminal  study  of  al-Qa 'ida  networks 
downplayed  the  presence  of  mental  disorder.  His  first  study  of 
172  individuals  highlighted  one  case  of  “probable  mild  mental  re¬ 
tardation  or  borderline  intellectual  functioning”  and  two  cases  of 
“psychotic  disorders.”  Sageman  notes  this  is  “about  the  incidence 
of  these  disorders  in  the  general  population.”13  In  Sageman’s  up¬ 
dated  analysis  of  around  500  individuals,  “there  were  about  four 
with  hints  that  they  experienced  beliefs  that  were  not  based  in  re¬ 
ality,”  but  there  was  ‘little  evidence  for  any  personality  disorder.”11 
It  should  be  noted,  however,  that  these  figures  may  be  a  function  of 
the  actors  being  largely  network-based.  The  current  threat  is  more 
varied  with  a  higher  propensity  for  lone  actors,  so  we  may  also  ex¬ 
pect  the  presence  of  mental  disorders  to  differ.  It  may  be  better  to 
focus  on  al-Qa '  ida  inspired  lone-actors  for  insight.  In  Paul  Gill, 
John  Horgan,  and  Paige  Deckert’s  study  of  119  lone-actor  terror¬ 
ists,  43%  were  al-Qa 'ida-inspired.  Of  this  sub-sample,  25%  had 
a  diagnosed  mental  disorder,  which  is  essentially  the  same  as  the 
population  base  rate.  This  figure,  however,  was  significantly  lower 
than  those  lone  actors  inspired  by  single-issue  causes  (52%)  such  as 
anti-abortion,  environmentalism,  and  animal  rights.15 

In  preparing  this  article,  the  authors  looked  at  55  attacks  (total¬ 
ing  76  individuals)  between  May  1,  2014,  and  September  30,  2016, 


JANUARY  2017 


CTC  SENTINEL 


3 


where  media  reports  indicated  they  were  possibly  influenced  in 
some  way  by  the  Islamic  State/ (See  appendix).  These  cases  encom¬ 
pass  both  Islamic  State-inspired  attacks  and  Islamic  State-directed 
attacks  as  well  as  attacks  enabled  by  communications  with  Islamic 
State  operatives  who  provided  guidance  to  attackers  without  them 
ever  connecting  to  the  group  in  person.8  And  they  include  both 
confirmed  Islamists  and  troubled  individuals  with  unconfirmed 
ideological  commitment  to  Islamist  causes  who  may  just  have  been 
influenced  by  the  group’s  calls  to  violence.  A  history  of  psycholog¬ 
ical  instability11  was  noted  in  21  (27.6%)  of  the  individuals.  This  is 
broadly  comparable  to  the  current  worldwide  average  (25-27%). 
The  authors  were  not  able  to  find  examples  of  psychological  insta¬ 
bility  in  the  media  reporting  on  those  alleged  to  have  taken  part 
in  Islamic  State  directed  attacks  (for  example,  the  November  2015 
Paris  attacks  and  the  March  2016  Brussels  attacks).  Excluding  Is¬ 
lamic  State-directed  plots,  the  percentage  of  attackers  with  reported 
psychological  instability  was  34.4%. 

It  is  worth  noting  that  some  of  those  with  overt  mental  health 
problems  may  not  have  been  inspired  by  the  Islamic  State  but  were 
simply  professing  Allahu  akbar  because  it  is  well  recognized  as  a 
phrase  used  in  violent  attacks.  As  these  cases  were  dismissed  as  not 
being  terrorism,  there  was  barely  any  (in  many  cases  no)  further 
media  reporting  as  to  the  individual’s  intentions,  and  therefore, 
the  degree  to  which  they  were  truly  Islamic  State  inspired  is  not 
currently  known. 

These  are  extremely  preliminary  results/  There  are  several  prac¬ 
tical  constraints  to  a  full-blown  study  akin  to  Sageman’s  at  this  mo¬ 
ment.  On  a  very  basic  level,  it  is  difficult  to  put  a  true  figure  on  the 
prevalence  rates  simply  because  the  vast  majority  of  cases  have  yet 
to  be  examined  in  a  court  of  law.  If  one  thinks  about  the  reliability 
of  sources  on  a  credibility  continuum  with  trial  evidence  on  the 


f  Cases  were  chosen  following  expansive  searches  of  multiple  open 
source  outlets,  using  the  LexisNexis  open  source  archive  of  academic 
and  media  articles  as  a  starting  point.  Cases  were  determined  to  be 
“possibly  influenced”  by  the  Islamic  State  following  cross-referencing  of 
information.  The  authors  did  not  include  cases  where  media  reporting 
indicated  inspiration  came  from  Islamist  terrorist  groups  other  than  the 
Islamic  State,  such  as  the  July  2015  Chattanooga,  Tennessee,  attack.  See 
Devlin  Barret  and  Arian  Campo-Flores,  “Investigators  See  Radicalization  in 
Chattanooga  Shooter,”  Wall  Street  Journal.  July  21,  2015. 

g  By  “Islamic  State-directed"  attacks,  the  authors  mean  attacks  involving 
Islamic  State  fighters  recruited  in  person  into  the  group  and  tasked  by  the 
group  to  launch  attacks. 

h  The  threshold  the  authors  used  for  determining  psychological  instability 
was  individuals  reported  to  have  had  a  history  of  psychiatric  or 
psychological  intervention  for  perceived  mental  problems  or  mental  health 
interventions  and/or  diagnoses  after  their  attacks.  Cases  in  which  family 
members  reported  depression  or  erratic  behavior  or  mental  health  issues 
that  did  not  result  in  such  interventions  were  not  included.  For  example, 
Orlando  nightclub  shooter  Omar  Mateen  was  not  classed  as  having 
psychological  instability  because  although  his  former  wife  told  reporters  he 
was  “mentally  ill,”  the  authors  were  not  able  to  find  any  evidence  there  was 
any  mental  health  intervention.  Greg  Toppo,  "Ex-wife:  Orlando  shooter  ‘very 
short-tempered,'  violent,"  USA  Today.  June  12,  2016. 

i  These  results  differ  from  the  earlier  work  of  the  authors,  where  more 

comprehensive  cases,  particularly  regarding  mental  health  status,  could  be 
formed.  The  cases  of  Corner  and  Gill  (2015),  and  Corner,  Gill,  and  Mason 
(2016)  were  drawn  from  individuals  who  had  either  been  convicted  of  a 
terrorist  act  or  died  in  the  commission  of  their  offense.  The  large  majority 
of  Islamic  State-linked  cases  referenced  in  this  article  have  not  reached 
trial  stage,  and  there  is  therefore  less  concrete  information  to  draw  from 
and  analyze. 


highest  end,  the  vast  majority  of  cases  are  still  reliant  on  sources 
from  the  lower  end. 

When  dealing  solely  with  this  lower  end,  researchers  need  to  be 
careful  of  a  number  of  potential  pitfalls.  Many  high-profile,  Islamic 
State-inspired  individuals  have  undoubtedly  either  shown  symp¬ 
toms  of  psychological  distress  in  earlier  years  or  have  been  formally 
diagnosed  with  a  disorder.  However,  at  a  time  when  rigorous  and 
interdisciplinary  insight  was  needed,  many  researchers,  reporters, 
and  practitioners  turned  to  flippant  language  and  coinage.  Such 
phrases  not  only  failed  to  explain  the  relationship  (if  any)  between 
terrorist  engagement  and  psychopathology  but  also  potentially 
stigmatized  the  infinitesimally  greater  number  of  individuals  suf¬ 
fering  from  some  form  of  mental  disorder  with  absolutely  no  hint 
of  radicalization  or  plans  to  engage  in  violence.  These  include  Max 
Abrahms’  “loon  wolf”16  phrase,  a  term  that  he  applies  to  any  lone 
terrorist  suffering  any  form  of  mental  disorder  or  psychological  dis¬ 
tress.  The  “loon”  connotation  also  implies  crazy  or  deranged  and 
misses  the  fact  that  rational  planning  often  occurs  in  the  presence 
of  a  mental  disorder. 

Corner  and  Gill17  (these  authors)  empirically  compared  a  sam¬ 
ple  of  lone-actor  terrorists  with  mental  disorders  with  a  sample  of 
lone-actor  terrorists  without  mental  disorders.  They  found  that 
those  with  a  mental  disorder  were  just  as  (and  in  some  cases  more) 
likely  to  engage  in  a  range  of  rational  pre-attack  behaviors  as  those 
who  were  not.  Offenders  with  mental  disorders  were  more  likely  to 
express  violent  desires,  seek  legitimization  for  their  intended  ac¬ 
tions,  stockpile  weapons,  train,  carry  out  a  successful  attack,  kill 
and  injure,  discriminate  in  their  targeting,  and  claim  responsibility. 
Most  of  these  traits  are  typically  viewed  as  rational  behaviors  to 
achieve  terrorism  goals. 

Other  popular  terms  used  on  Twitter  are  “Islamopsychotics”  and 
“Mentalhadist,”  terms  that  conflate  religious  devotion  with  mental 
illness,  thus  simplifying  and  demonizing  both.18  Such  conceptually 
loose  and  boundary-less  terms  may  have  the  impact  of  also  inflating 
perceptions  of  the  prevalence  of  mental  disorders  (which  have  a 
very  strict  set  of  operationalized  and  bounded  criteria). 

A  second  obvious  problem  with  this  lower  end  of  the  credibility 
continuum  is  that  the  sources  are  sometimes  highly  questionable. 
Again,  this  may  artificially  inflate  the  true  prevalence  rate.  In  many 
cases,  anonymous  sources  allude  to  the  individual’s  (usually  unspec¬ 
ified)  strange  and  erratic  behaviors  prior  to  their  radicalization.  It 
is  often  implied  and  assumed  that  this  is  related  to  mental  health 
problems,  but  the  reporting  is  unspecific.  For  example,  on  Septem¬ 
ber  23,  2014,  Numan  Haider  stabbed  and  injured  two  counterter¬ 
rorism  officers  in  the  parking  lot  of  a  police  station  in  Melbourne, 
Australia.  Haider  was  shot  dead  at  the  scene.  There  is  evidence  that 
his  family  previously  encouraged  him  to  seek  help  from  a  counsel¬ 
or  for  erratic  behavior.19  However,  this  was  most  likely  linked  to 
their  worries  over  his  potential  radicalization  rather  than  mental 
health  issues.20  Other  cases  reporting  “erratic  behavior”  include  Mi¬ 
chael  Zehaf-Bibeau  (the  Parliament  of  Canada  shooter)  and  Zale 
Thompson  (who  attacked  four  New  York  City  police  officers  with  a 
hatchet).  All  three  examples  fall  short  of  a  confirmed  mental  health 
diagnosis  of  any  sort.  All  three,  however,  have  been  held  up  as  irre¬ 
futable  evidence  of  the  link  between  mental  health  problems  and 
radicalization.  The  bar  for  confirming  evidence  should  be  higher 
within  research  and  practitioner  communities. 

Other  cases  highlight  instances  where  mental  health  problems 
were  alluded  to  by  non-experts  (often  family,  friends,  neighbors)  but 
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latched  onto  by  the  wider  media  as  concrete  evidence  of  a  disorder’s 
presence  (and  presumably  direct  role  in  the  violent  intent/actions). 
Worryingly,  now  that  concrete  empirical  evidence  has  demonstrat¬ 
ed  the  greater  propensity  for  lone-actor  terrorists  to  have  a  mental 
health  problem,  it  is  often  one  of  the  first  lines  of  investigation  in 
media  reporting.  The  below  examples,  while  interesting,  show  the 
disturbingly  low  levels  of  evidence  provided  within  some  reporting 
that  depicts  the  individual  as  having  a  mental  disorder.  Such  report¬ 
ing  has  potentially  overinflated  the  true  rates. 

On  October  20,  2014,  Martin  Couture-Rouleau,  a  25-year-old 
French  Canadian  who  converted  to  Islam  in  2013,  deliberately 
rammed  his  car  into  two  Canadian  Armed  Forces  soldiers  in  a  shop¬ 
ping  center  parking  lot  in  Saint-Jean-sur- Richelieu,  Quebec,  Can¬ 
ada.  One  soldier  was  killed.  Couture-Rouleau  was  shot  following 
a  chase  and  altercation  with  a  female  police  officer.  No  confirmed 
diagnoses  exist,  but  neighbors  claim  he  was  “depressed,”  and  one 
additional  source  claimed  Couture-Rouleau’s  father  had  previously 
attempted  unsuccessfully  to  admit  him  to  psychiatric  care.21 

On  January  7,  2016,  Edward  Archer  shot  and  wounded  a  police 
officer  in  Philadelphia.  When  apprehended,  Archer  confessed  that 
he  committed  the  attack  in  the  name  of  Islam  and  pledged  alle¬ 
giance  to  the  Islamic  State.  Archer’s  mother  claimed  that  he  had 
sustained  a  traumatic  head  injury  from  a  moped  accident  and  that 
he  had  “some  form”  of  mental  illness  because  “he’s  been  talking 
to  himself ...  laughing  and  mumbling”  and  “hearing  voices  in  his 
head.”22 

On  June  12,  2016,  Omar  Mateen,  a  29-year-old  American  cit¬ 
izen  of  Afghan  descent,  attacked  the  Pulse  nightclub  in  Orlando, 
Florida,  killing  49  individuals.  Mateen  was  shot  and  killed  by  law 
enforcement  following  an  extended  standoff.  Mateen  had  a  history 
of  disruptive  behavior  while  at  school.  When  Mateen  applied  for  his 
security  guard’s  license  in  2007  and  its  renewal  in  2013,  no  psycho¬ 
logical  issues  were  noted  at  screening.  Mateen  was  a  habitual  user 
of  steroids,  and  his  first  wife  claimed  that  he  was  “mentally  unsta¬ 
ble  and  mentally  ill.”23  There  is  no  further  evidence  to  support  this 
claim,  however.  Confusion  remains  over  Mateen’s  exact  motives,  as 
he  pledged  allegiance  to  the  Islamic  State  just  prior  to  this  attack 
over  the  phone.  Multiple  witnesses  have  also  claimed  that  Mateen 
was  homosexual  and  struggled  to  come  to  terms  with  his  sexuality.24 

Other  cases  are  complicated  by  continuing  questions  over  the 
degree  of  psychological  distress  and  other  vulnerabilities.  On  July 
24,  2016,  Mohammad  Daleel,  a  27-year-old  Syrian  refugee,  carried 
out  a  suicide  bombing  in  Ansbach,  Germany.  Only  the  assailant  was 
killed.  Investigators  believe  he  had  planned  to  detonate  the  device 
remotely,  was  planning  follow-on  attacks,  and  his  death  was  an  ac¬ 
cident.25  Daleel,  who  had  been  treated  by  a  trauma  therapist  who 
warned  he  might  engage  in  a  “spectacular”  suicide  attempt,26  twice 
was  reported  as  attempting  suicide  following  failed  asylum  applica¬ 
tions  in  Germany,  after  which  his  deportation  was  stalled.27  Eleven 
days  before  the  bombing,  Daleel  was  again  served  a  deportation 
order.  Given  the  Islamic  State’s  claim  that  he  was  previously  part  of 
the  group  in  Syria28  and  detailed  instructions  he  was  receiving  in 
communication  with  a  suspected  Islamic  State  handler  overseas,29 
some  have  pointed  to  the  possibility  that  he  might  have  exaggerated 
his  mental  health  problems  to  escape  deportation.30  As  it  is  difficult 
to  determine  whether  his  earlier  suicide  attempts  were  used  as  a 
function  to  avoid  deportation  or  due  to  underlying  distress,  it  is 
difficult  to  disentangle  these  actions  from  the  form  of  violence  he 
ultimately  chose  to  engage  in  on  behalf  of  the  Islamic  State. 


Orlando  shooter  Omar  Mateen  (F.B.I.) 


In  other  cases,  specific  diagnoses  were  made  but  are  not  public¬ 
ly  available.  On  March  14,  2016,  Ayanle  Hassan  Ali,  a  27-year-old 
Canadian,  stabbed  two  soldiers  at  a  recruitment  center  in  Toronto, 
Canada.  Following  the  attack,  Ali  told  officers  “Allah  told  me  to  do 
this,  Allah  told  me  to  come  here  and  kill  people.”  Ali  was  initially 
deemed  unfit  to  stand  trial  due  to  “psychotic  symptoms  of  a  major 
mental  illness,”  but  following  mandatory  treatment,  Ali  was  found 
fit  to  stand  trial  for  a  range  of  charges.31 

On  July  14,  2016,  Mohamed  Lahouaiej-Bouhlel,  a  31-year-old 
Tunisian  with  French  residency,  drove  a  19-ton  cargo  truck  into  a 
crowd  of  individuals  celebrating  Bastille  Day  on  the  Promenade  des 
Anglais,  Nice.  Lahouaiej-Bouhlel  was  shot  and  killed  by  police  after 
he  managed  to  drive  over  one  mile  through  the  crowded  streets 
and  pedestrian  areas.  According  to  reports,  Lahouaiej-Bouhlel  had 
only  started  attending  a  mosque  two  months  prior  to  the  attack.32 
Lahouaiej-Bouhlel’s  father  claimed  that  his  son  had  undergone  psy¬ 
chiatric  treatment  prior  to  2005  and  had  a  nervous  breakdown  and 
a  history  of  substance  misuse  and  depression.33 

On  July  26,  2016,  Adel  Kermiche  and  Abdel  Malik  Petitjean  took 
six  people  captive  in  the  church  of  Saint-Etienne-du-Rouvray,  Nor¬ 
mandy,  before  killing  a  priest.  Kermiche  was  born  in  Algeria,  and  he 
had  twice  attempted  to  travel  to  Syria  in  2015  and  was  jailed.34  The 
attackers  were  shot  and  killed  when  police  stormed  the  church.  Fol¬ 
lowing  the  attack,  psychological  reports  carried  out  at  Kermiche’s 
trial  prior  to  the  attack  in  October  2015  suggested  that  Kermiche 
had  a  history  of  mental  health  problems.35  This  also  highlights  an 
additional  problem:  when  the  offenders  die  at  the  scene  of  the  at¬ 
tack,  psychiatrists  cannot  access  the  offenders  to  assess  their  mental 
health.  If  not  for  his  previous  dalliance  with  the  law,  Kermiche’s 
mental  health  issues  might  have  been  missed  entirely. 

The  fact  is  that  confirmed  diagnoses  in  recent  cases  remain  few 
and  far  between.  In  December  2014,  Man  Haron  Monis,  a  50-year- 
old  Iranian  living  in  Australia,  took  hostages  at  the  Lindt  Cafe  in 
Sydney.  The  siege  lasted  over  12  hours  and  ended  when  security 
officials  stormed  the  cafe  and  shot  Monis.  Two  others  were  killed. 
Monis  had  claimed  allegiance  with  the  Islamic  State,  and  following 
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the  siege,  the  Islamic  State  praised  his  actions  in  its  propaganda.36 
Monis  had  an  extensive  history  of  mental  health  issues.  Forensic 
psychologist  Kate  Barrelle,  advisor  to  the  coroner  in  Monis’  case, 
concluded  that  the  attacker  suffered  from  “narcissism,  paranoia, 
and  antisocial  behaviour  disorder.”37  Forensic  psychiatrist  Jonathan 
Phillips  concurred  with  Barrelle.  He  dismissed  the  possibility  that 
Monis  also  suffered  from  comorbid  disorders  by  explaining  that 
earlier  non-psychosis-related  diagnoses  were  no  different  from 
“what  everyone  experiences  ‘from  time  to  time.’”  Phillips  explained 
that  his  diagnostic  decision  was  based  on  Monis’  history  of  sexu¬ 
al  assaults  and  that  he  “orchestrated  the  incident  in  a  meticulous 
and  callous  manner.”38  Counsel  assisting  the  coroner  at  the  inquest, 
Jeremy  Gormly,  SC.,  surmised  Phillips’  conclusions:  “[Monis]  was 
suffering  from  some  definable  personality  disorders,  including  an¬ 
ti-social,  paranoid  and  narcissistic  tendencies,  but  did  not  suffer  a 
mental  illness  and  his  actions  cannot  be  attributed  to  mental  ill¬ 
ness.”39 

On  January  7, 2015,  Amedy  Coulibaly,  a  French  extremist  claim¬ 
ing  to  act  on  behalf  of  the  Islamic  State,  shot  and  wounded  a  jogger 
in  Paris.40  A  day  later,  he  is  suspected  of  having  killed  a  French  mu¬ 
nicipal  police  officer.  The  following  day,  he  murdered  four  hostages 
at  a  kosher  supermarket.  A  psychiatrist  had  previously  assessed  him 
following  earlier  criminal  behavior  and  found  that  Coulibaly  had 
an  “immature  and  psychopathic  personality”  but  stopped  short  of 
diagnosing  a  specific  mental  disorder.41 

In  December  2015,  Muhaydin  Mire  attacked  commuters  at  Ley- 
tonstone  underground  station  in  London  with  a  breadknife,  injur¬ 
ing  three.  Mire  reportedly  claimed,  “This  is  for  Syria,  my  Muslim 
brothers.”42  Mire  had  a  history  of  mental  illness  and  had  spent  time 
in  psychiatric  institutions  for  delusional  and  paranoid  tendencies 
with  some  reports  of  paranoid  schizophrenia.43  Mire’s  family  had 
also  sought  to  have  him  admitted  one  month  prior  to  the  attack.44 

In  a  recent  and  complicated  case,  Esteban  Santiago-Ruiz  killed 
five  and  injured  another  six  in  a  shooting  at  Fort  Lauderdale  airport 
in  January  2017-  Federal  officials  confirmed  that  Santiago-Ruiz  had 
received  psychological  treatment.  His  family  members  claim  that 
his  problems  stemmed  from  witnessing  two  fellow  servicemen  die 
in  combat  in  Iraq.45  Two  months  prior  to  the  attack,  Santiago-Ruiz 
visited  an  F.B.I.  field  office  and  reported  the  U.S.  government  con¬ 
trolled  his  mind  and  made  him  watch  Islamic  State-related  videos. 
The  C.I.A.  was  also  forcing  him  to  join  the  group,  according  to  San¬ 
tiago-Ruiz.  After  the  attack,  Santiago-Ruiz  initially  made  similar 
claims.  However,  after  Santiago-Ruiz  was  transferred  to  an  F.B.I. 
office  following  the  attack,  he  claimed  he  carried  out  the  attack  on 
behalf  of  the  Islamic  State  and  had  not  again  mentioned  mind  con¬ 
trol,  an  F.B.I.  agent  testified  on  January  17-  Despite  Santiago-Ruiz’ 
later  claims,  the  Islamic  State  are  yet  to  claim  responsibility  for  the 
attack.46  Investigators  are  continuing  to  disentangle  Santiago-Ruiz’ 
motivation,  and  whether  the  attack  was  motivated  by  voices  in  his 
head  telling  him  to  commit  acts  of  violence.47  Here,  the  link  between 
mental  state  and  the  violence  appears  to  be  much  clearer  than  in 
many  other  cases.  However,  the  depth  of  his  ideological  orientation 
toward  the  Islamic  State  is  highly  questionable  at  the  time  of  writ¬ 
ing.  For  the  authors,  he  looks  far  more  like  other  mass  murderers 
such  as  Myron  May  (the  Florida  State  University  shooter),  Aaron 
Alexis  (the  Washington  Navy  Yard  shooter  and  Jiverly  Wong  (the 


Binghamton  shooter).1  All  three  individuals  reported  being  ‘target¬ 
ed  individuals’  and  acted  violently  in  order  to  get  the  government 
to  turn  off  their  mind-control  machines. 

In  many  other  cases,  when  confirmed  diagnoses  were  pres¬ 
ent,  there  was  a  tendency  to  try  dismiss  the  possibility  of  terror¬ 
ism  altogether.  For  example,  on  December  21,  2015,  an  unnamed 
40-year-old  ran  over  11  pedestrians  across  the  city  of  Dijon,  France, 
while  shouting  “Allahu  akbar,”  claiming  he  was  “acting  on  behalf 
of  the  children  of  Palestine,”  and  brandishing  a  knife.  Police  knew 
the  assailant  for  previous  minor  offenses,  and  he  had  spent  time 
in  psychiatric  services.  Due  to  the  psychiatric  history  of  the  assail¬ 
ant,  authorities  deemed  the  attack  not  to  be  an  act  of  terrorism.48 
A  similar  attack  that  injured  10  in  December  2014  in  Nantes  was 
similarly  dismissed  as  non-terrorism  because  the  individual  was 
“unbalanced.”49  On  May  10,  2016,  an  individual  attacked  commut¬ 
ers  with  a  knife  at  Grafing  train  station  near  Munich.  One  victim 
died  from  his  wounds.  The  assailant  reportedly  shouted  “Allahu 
akbar”  and  continued  to  espouse  similar  sentiments  such  as  “all 
infidels  must  die.”  This  was  later  confirmed  by  police  authorities 
but  dismissed  as  terrorism  because  the  individual  was  “mentally 
disturbed.”50  Moussa  Coulibaly’s  stabbing  of  three  anti-terrorism 
police  officers  in  Nice  in  February  2015  was  similarly  rejected  by 
authorities  as  terrorism  because  he  was  viewed  as  an  “unbalanced 
individual.”51 

Nowhere  was  this  debate  on  whether  attacks  were  terrorism 
or  non-politically  motivated  acts  of  mentally  disturbed  individ¬ 
uals  more  evident  than  in  the  Man  Haron  Monis  inquest.  Many 
commentators  reasoned  it  was  his  history  of  mental  disorder  that 
best  explains  his  actions  and  that  he  should  not  be  considered  a 
terrorist.  For  example,  Dr.  Rodger  Shanahan,  a  research  fellow 
at  the  Lowy  Institute,  argued  at  the  inquest  that  Monis  was  “not 
motivated  by  political,  ideological  or  religious  causes,  but  rather 
was  someone  with  mental  health  issues  acting  on  his  own  personal 
grudges.”52  Shanahan  also  argued  that  “if  he  [Monis]  was  following 
IS  [Islamic  State]  direction  why  didn’t  he  go  in  there  and  kill  ev¬ 
eryone?”53  Shanahan  instead  believed  that  Monis  chose  the  Lindt 
Cafe  for  personal  rather  than  political  reasons,  highlighting  Monis’ 
historical  grievance  with  Seven  Network’s  Sunrise  television  pro¬ 
gram,  whose  studios  were  across  the  road  from  the  cafe.  Shanahan 
also  drew  on  Monis’  lack  of  direct  connection  to  the  Islamic  State 
and  his  wearing  of  a  headband,  which  has  an  association  with  the 
Shi '  a  sect  of  Islam  and  is  considered  heretical  by  the  Islamic  State.54 
Clarke  Jones  of  Australian  National  University  agreed  with  Shana¬ 
han,  explaining  that  due  to  his  mental  health  problems,  Monis  was 
desperate  to  attach  himself  to  a  cause,  further  explaining  that  his 
actions  were  extremely  hard  to  predict.55  Terrorism  scholar  Bruce 
Hoffman  held  an  opposing  view.  Monis’  history  of  mental  disorder, 
in  Hoffman’s  opinion,  was  “immaterial”  as  to  whether  he  carried 
out  a  terrorist  attack.56 

The  debate  rests  on  the  question  about  whether  the  presence  of 
a  mental  health  diagnosis  is  enough  to  state  that  it  was  a  driver  of 
the  radicalization-linked  behavior  or  whether  it  was  just  one  ingre- 


j  Myron  May  recorded  an  extensive  explanation  (1  hr.  47  min.  video)  of  his 
opinion  regarding  being  a  targeted  individual  shortly  before  carrying  out 
the  shooting  at  Florida  State  University.  Within  the  recording,  he  refers  to 
“other  targeted  individuals,  Aaron  Alexis,  and  Jiverly  Wong."  This  video  was 
uploaded  following  his  attack  and  death.  “The  Apprentice  of  Flonor  “Myron 
May  mind  control  victim,”  YouTube,  March  27, 2015. 
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dient  in  the  individual’s  vulnerability  profile  and  grievance  struc¬ 
ture.  Some  tentative  answers  are  available  in  the  wider  research 
literature. 

Corner  and  Gill57  utilized  a  sample  of  119  lone-actor  terrorists 
and  investigated  whether  certain  behaviors  within  the  chain  of 
events  that  led  to  a  terrorist  attack  were  more  likely  to  co-occur 
with  certain  diagnoses  than  others.  Those  diagnosed  with  schizo¬ 
phrenia  and  associated  disorders  were  the  only  diagnostic  group 
to  be  significantly  associated  with  previous  violent  behavior  and 
this  supports  previous  research  in  the  general  violence  literature.58 
This  could  be  linked  to  the  lowering  of  inhibitions  against  violence 
or  potentially  the  increased  chances  the  individual  had  previously 
engaged  in  (non-terrorist)  violence.15  Those  with  personality  disor¬ 
ders  and  autism  were  less  likely  to  have  a  spouse/partner  involved 
in  a  terrorist  movement,  which  may  be  indicative  of  not  having  a 
spouse  due  to  the  detrimental  nature  of  these  disorders.  Because 
mental  disorders  often  share  symptoms  (and  because  diagnoses 
are  often  not  available),  further  research  may  also  focus  on  ana¬ 
lyzing  symptoms  of  mental  illness  rather  than  purely  the  diagno¬ 
ses  themselves.59  The  results  of  this  investigation  offer  insight  into 
links  between  specific  disorder  types,  and  specific  behaviors,  that 
in  isolation  can  be  linked  to  a  wide  range  of  activities,  not  just  those 
found  in  a  terrorist  attack.  Researchers  are  yet  to  study  temporal 
trajectory  of  behaviors,  and  how  these  interact  with  each  other  and 
the  wider  environment  in  space  and  time.  We  just  know  some  be¬ 
haviors  co-occurred  at  some  point  in  the  individual’s  life-course. 
John  Horgan  correctly  notes  that  although  studies  of  lone  actors 
often  find  high  preponderance  of  mental  health  issues  within  the 
sample,  “detailed  research  would  be  needed  to  further  clarify  the 
precise  nature  and  role  (if  any)  of  mental  health  problems  in  the 
development  of  their  violent  activity.”60 

This  debate  is  on-going  within  the  wider  study  of  crime  as 
well.  On  the  one  hand,  a  strand  of  research  assumes  a  consistent 
causal  link  between  psychiatric  symptoms  (where  they  are  found 
to  be  present)  and  criminal  behavior.61  On  the  other  hand,  a  more 
nuanced  strand  of  research  argues  there  are  “a  (small)  group  of 
offenders  whose  symptoms  relate  directly  to  crime  and  a  (larger) 
group  whose  symptoms  and  crimes  are  not  directly  related.”62  For 
example,  various  studies  illustrate  that  the  offender  (across  a  range 
of  crimes)  experienced  his/her  psychiatric  symptoms  at  the  time  of 
the  (often  violent)  crime  between  4%  and  18%  of  the  time.63  There 
is  no  reason  to  suggest  this  should  be  any  different  for  a  terrorist 
subset  of  offenders.  If  anything,  one  might  presume  the  figures  to 
be  lower  given  the  wider  ideology  and  ideologues  underpinning  it 
provide  a  grievance  and  set  of  instructions  on  who  to  target  and 
how.  A  complex  mixture  of  personality,  situational,  and  personal 
drivers  (among  others)  likely  drives  most  general  crime.  Terrorism 
is  no  different  but  for  the  addition  of  an  overarching  ideology.  The 
presence  of  this  ideology  in  the  motivational  mix  therefore  likely 
lessens  the  relative  cognitive  response  to  mental  health  problems. 


k  For  over  40  years,  argument  has  ensued  in  the  schizophrenia  and  violence 
literature  as  to  whether  schizophrenia  is  definitively  linked  to  an  increased 
risk  of  engaging  in  violence.  There  are  multiple  extraneous  risk  factors 
that  individuals  with  schizophrenia  may  be  exposed  to  (e.g.  drug  use, 
homelessness)  that  are  now  recognized  as  increasing  the  risk  of  violence 
across  populations,  not  just  among  those  with  schizophrenia. 


Conclusion 

It  is  simply  too  early  to  come  to  a  definitive  answer  regarding  the 
role  of  mental  health  problems  and  various  forms  of  Islamic  State 
terrorism.  Mental  disorders  appear  more  prevalent  among  those 
inspired  by  Islamic  State  than  those  directed  by  it.  Beyond  that, 
however,  it  is  difficult  to  make  clear  conclusions.  The  available 
open-source  information  is  clouded  by  poor  reporting  practices, 
the  tendency  to  treat  all  mental  health  disorders  equally,  and  the 
fetishized  way  mental  health  is  reported.  The  answer  is  likely  to 
differ  wildly  from  case  to  case  depending  upon  the  individual’s  di¬ 
agnosis,  prior  life  experiences,  co-existence  of  other  stressors  and 
vulnerabilities,  and  lack  of  protective  factors.  Researchers  need  to 
have  a  mature  enough  response  in  practice,  research,  and  public 
discussion  that  is  comfortable  with  this  complexity;  understand 
that  where  it  is  present,  it  is  usually  one  of  several  drivers;  and  do 
so  by  not  stigmatizing  the  vast  majority  that  suffer  from  mental 
health  problems  while  remaining  non-violent,  non-radicalized,  and 
in  need  of  care. 

What  we  see  from  the  existing  research  is  that  lone-actor  terror¬ 
ism  is  usually  the  culmination  of  a  complex  mix  of  personal,  polit¬ 
ical,  and  social  drivers  that  crystalize  at  the  same  time  to  drive  the 
individual  down  the  path  of  violent  action.  This  should  be  no  dif¬ 
ferent  for  those  inspired  by  the  Islamic  State.  Whether  the  violence 
comes  to  fruition  is  usually  a  combination  of  the  availability  and 
vulnerability  of  suitable  targets  and  the  individual’s  capability  to  en¬ 
gage  in  an  attack  from  both  a  psychological  and  technical  capability 
standpoint.  Many  individual  cases  share  a  mixture  of  personal  life 
circumstances  coupled  with  an  intensification  of  beliefs  that  later 
developed  into  the  idea  to  engage  in  violence.  What  differs  is  how 
these  influences  were  sequenced.  Sometimes  personal  problems  led 
to  a  susceptibility  to  ideological  influences.  Sometimes  long-held 
ideological  influences  became  intensified  after  the  experience  of 
personal  problems.  This  is  why  we  should  be  wary  of  mono-causal 
‘master  narratives’  about  how  this  process  unfolds.  Mental  health 
problems  are  undoubtedly  important  in  some  cases.  Intuitively,  we 
might  see  how  in  some  cases  it  can  make  carrying  out  violence  eas¬ 
ier.  In  other  cases,  it  may  make  the  adoption  of  the  ideology  easier 
because  of  delusional  thinking  or  fixated  behaviors.  However,  it  will 
only  ever  be  one  of  many  drivers  in  an  individual’s  pathway  to  vio¬ 
lence.  In  many  cases,  it  may  be  present  but  completely  unrelated. 
The  development  of  radicalization  and  attack  planning  behaviors 
is  usually  far  more  labyrinthine  and  dynamic  than  one  single  fac¬ 
tor  can  explain,  be  it  mental  disorders  (today’s  go-to  silver-bullet 
explanation),  online  radicalization  (another  popular  silver-bullet 
explanation),  or  root  causes  that  encompass  socio-demographic 
characteristics. 

We  must  also  bear  in  mind  that  the  relationship  between  men¬ 
tal  health  problems  and  terrorist  engagement  is  just  one  part  of 
the  story.  Given  the  scale  and  types  of  violence  being  conducted  by 
the  Islamic  State,  many  perpetrators  will  develop  mental  health 
problems  as  a  byproduct  of  involvement  as  opposed  to  it  being  a 
driver  of  involvement.  There  will  also  be  a  generation  of  children 
who  were  born  within  the  Islamic  State  and/or  trained  as  fighters, 
many  of  whom  will  return  to  their  parents’  country  of  origin  in  the 
coming  years.  The  interface  of  mental  health  practitioners  and  the 
Islamic  State  will,  therefore,  not  just  be  limited  to  assessing  the  risk 
of  whether  someone  will  become  a  terrorist  but  will  be  extended  to 
safeguarding  and  treatment. 

In  conclusion,  after  many  years  in  the  dark,  the  link  between 
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mental  health  problems  and  terrorist  engagement  is  now  often 
the  “go-to”  explanation.  This  is  partially  due  to  the  studies,  cited 
above,  that  showed  the  relatively  high  rates  within  specific  terror¬ 
ist  sub-samples.  These  studies  coalesced  in  time  with  an  uptick  in 
Islamic  State  lone-actor  plots  and  attacks  and  were  latched  onto  by 
media,  the  public  and  policymaker  communities  hungry  for  intui¬ 
tively  appealing  and  straightforward  answers.  Much  of  the  nuance 


within  these  studies  was  lost,  however.  Just  because  a  factor  (such 
as  mental  disorder)  was  present,  does  not  make  it  causal.  Nor  does 
it  necessarily  make  it  facilitative.  It  may  be  completely  irrelevant 
altogether.  Contemporary  media  reporting  may  have  led  to  a  poten¬ 
tially  overinflated  sense  of  how  prevalent  the  link  truly  is  and  how 
closely  tied  it  is  to  the  individual’s  pathway  into  terrorism.  CTC 


Appendix:  Attacks  Possibly  Influenced  by  the  Islamic  State  and  Psychological  Instability 


Month/Year 

Attacks  Possibly  Influenced  by  the  Islamic  State 
(according  to  media  reports) 

Media  Reporting  on  Psychological  or 
Psychiatric  Intervention 

May  2014 

Brussels  Jewish  Museum  shooting 

No 

September  2014 

Endeavor  Hills,  Melbourne  stabbing 

No,  but  evidence  of  counselor  intervention 
for  radical  behavior 

September  2014 

Moore,  Oklahoma  beheading  attack 

Yes 

October  2014 

Saint-Jean-sur- Richelieu,  Quebec  vehicular 
ramming 

Yes 

October  2014 

Ottawa  Parliament  shooting 

Yes 

October  2014 

New  York  hatchet  attack 

No,  but  family  reporting  of  depression 

October  2014 

Kvissel,  Denmark  murder 

No 

December  2014 

Sydney  Lindt  Cafe  siege 

Yes 

December  2014 

Joue-les-Tours,  France  police  station  stabbing 

No 

December  2014 

Dijon  vehicular  ramming 

Yes 

January  2015 

Metz  police  assault 

Yes 

January  2015 

Paris  kosher  market  attack  and  murder 

No;  received  psychological  assessment 
without  specific  diagnosis  or  treatment 

February  2015 

Nice  police  stabbing 

Yes 

February  2015 

Copenhagen  shootings 

No 

April  2015 

Zvornik,  Bosnia  police  station  shooting 

No 

May  2015 

Garland,  Texas  shooting 

No 

June  2015 

Saint-Quentin-Fallavier,  France  factory  attack 

No,  but  attacker  committed  suicide  in  prison 

August  2015 

Thalys  train  attack 

No 

September  2015 

Sandholm  asylum  center  police  stabbing 

No 

October  2015 

Parramatta,  Sydney  police  shooting 

Yes 

November  2015 

University  of  California  stabbing 

No 

November  2015 

Marseille  anti-semitic  stabbing 

No 

November  2015 

Paris  attacks 

No 

December  2015 

San  Bernardino  attack 

No 

December  2015 

Leytonstone,  London  Tube  attack 

Yes 

January  2016 

Valence,  France  soldier  vehicular  ramming 

No 

January  2016 

Goutte  d’Or,  Paris  police  station  attack 

No 

January  2016 

Philadelphia  police  shooting 

Yes 

January  2016 

Marseille  Jewish  school  machete  attack 

No 
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February  2016 

Rochdale  Imam  murder 

No 

February  2016 

Hanover  police  stabbing 

No 

March  2016 

Toronto  army  recruitment  center  stabbing 

Yes 

March  2016 

Brussels  attacks 

No 

April  2016 

Kempsey,  Australia  prison  assault 

No 

April  2016 

Essen  Sikh  temple  bombing 

No 

May  2016 

Saint  Julien  du  Puy,  France  soldier  stabbing 

No 

May  2016 

Grafing,  Germany  train  station  stabbing 

Yes 

June  2016 

Etterbeek,  Brussels  stabbing 

No 

June  2016 

Florida  Pulse  night  club  shooting 

No 

June  2016 

Magnanville,  France  stabbings 

No 

July  2016 

Nice  truck  attack 

Yes 

July  2016 

Wurzburg,  Bavaria  train  stabbing 

No 

July  2016 

Ansbach,  Bavaria  suicide  bombing 

Yes 

July  2016 

Saint-Etienne-du-Rouvray  church  attack 

Yes  (for  one  assailant) 

August  2016 

Charleroi  police  stabbing 

No 

August  2016 

Strasbourg  stabbing 

Yes 

August  2016 

Queensland  hostel  stabbing 

Yes 

August  2016 

Oberhausen  music  festival  stabbing 

Yes 

August  2016 

Toulouse  police  stabbing 

Yes 

August  2016 

Copenhagen  shooting 

No 

September  2016 

Vincennes,  Paris  stabbing 

Yes 

September  2016 

Osny,  France  prison  attack 

No 

September  2016 

Taranto,  Italy  prison  attack 

No 

September  2016 

Minto,  Sydney  stabbing 

Yes 

September  2016 

Rimini  police  attack 

No 

Islamic  State-directed  attacks  by  individuals  recruited  in  person  into  the  group  and  tasked  with  launching  attacks  are  shaded  in  gray.  The 
Brussels  Jewish  museum  shooting  by  a  French  Islamic  State  recruit  was  not  categorized  as  Islamic  State-directed  because  it  is  not  yet  clear 
whether  he  was  tasked  by  the  group  to  launch  an  attack. 

All  the  attacks  involved  one  attacker  except  the  Paris  attacks  (nine  attackers),  the  Brussels  attacks  (five  attackers),  the  stabbing  attack  on  a 
Jewish  teacher  in  Marseille  (three  attackers),  the  Sikh  temple  bombing  in  Essen  (three  attackers),  the  San  Bernardino  attack  (two  attackers), 
theKvissel  murder  (two  attackers),  the  Saint-Etienne-du-Rouvray  church  attack  (two  attackers),  the  Rochdale  murder  (two  attackers),  and 
the  Saint  Julien  du  Puy  attack  (two  attackers).  In  total,  there  were  55  cases  involving  76  attackers.  There  was  media  reporting  indicating 
psychological  instability for  21  of  the  attackers  (27-6%).  Excluding  Islamic  State-directed  attacks,  the  percentage  of  attackers  with  reported 
psychological  instability  was  34.4%. 
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A  View  from  the  CT  Foxhole:  Peter  Edge,  ICE 
Acting  Deputy  Director,  and  Wil  van  Gemert, 
Europol  Deputy  Director 

By  Paul  Cruickshank 


Peter  T.  Edge  was  appointed  Acting  Deputy  Director  ofU.S. 
Immigration  and  Customs  Enforcement  (ICE)  on  January  20, 
2017-  At  the  time  of  this  interview,  he  was  Executive  Associate 
Director  of  Homeland  Security  Investigations  (HSI).  Prior  to 
this  position,  Mr.  Edge  served  as  Deputy  Executive  Associate 
Director  and  the  Special  Agent  in  Charge  in  the  HSI  Newark, 

New  Jersey,  regional  office.  Mr.  Edge  has  extensive  experience 
conducting  narcotics,  money  laundering,  commercial  fraud,  and 
corruption  investigations. 

Wil  van  Gemert  was  appointed  Deputy  Director  of  Europol  and 
Head  of  the  Operations  Department  in  May  2014.  He  previously 
filled  several  positions  in  the  Dutch  police  and  joined  the  Dutch 
National  Intelligence  Service  in  2004.  In  2012,  he  was  Director 
of  Cyber  Security  of  the  Dutch  Government.  In  his  current  role 
at  Europol,  he  manages  a  department  of  experts,  specialists  and 
analysts  dealing  with  serious  and  organized  crime  as  well  as 
terrorism  and  cybercrime. 

CTC:  What  role  do  your  organizations  play  in  identifying, 
tracking,  and  potentially  interdicting  foreign  terrorist  fighters 
who  have  traveled  to  Syria,  Iraq,  and  other  jihadi  battlegrounds? 
Edge:  When  it  comes  to  foreign  terrorist  fighters,  Homeland  Securi¬ 
ty  Investigations  [HSI,  a  directorate  within  the  U.S.  Department  of 
Homeland  Security’s  Immigration  and  Customs  Enforcement  (ICE) 
component]  is  a  border  security  investigative  agency  that  conducts 
transnational,  criminal  organization-related  investigations  around 
the  world.  We  have  a  very  vibrant  investigative  footprint  here  in  the 
United  States.  We  also  have  a  very  active  intelligence  program  that 
processes  a  lot  of  human  intelligence  information  through  various 
means,  and  we  have  a  significant  international  footprint.  We’re  in 
47  countries,  and  we  have  63  offices.  We’ve  leveraged  that  inter¬ 
national  connectivity  to  enhance  our  investigative  efforts  and  to 
share  information  with  our  partners,  not  only  on  a  bilateral  but  on 
a  multilateral  basis.  And  that’s  where  the  relationship  with  Europol 
has  been  critical  to  our  collective  success. 

Van  Gemert:  Europol  is  the  European  informational  hub  and  fu¬ 
sion  center  for  law  enforcement.  Unlike  CBP  [U.S.  Customs  and 
Border  Patrol]  or  ICE  HSI,  we  don’t  have  our  own  investigatory 
powers.  But  we  have  a  threefold  task:  firstly,  to  build  up  and  analyze 
the  data  and  information  available  in  the  28  E.U.  member  states 
in  different  fields  of  crime  including  terrorism;  secondly,  to  be  the 
center  of  expertise  in  those  fields  in  which  we  are  active — organized 
crime,  terrorism,  migration,  and  cyber  crime— and  finally,  to  coor¬ 
dinate  the  actions  of  the  different  member  states  so  as  to  ensure 
that  information  is  turned  into  operational  actions  and  real  time 
cross-border  investigations.  In  recent  years,  we  moved  from  not 
only  collecting  information  but  to  connecting  information.  For  the 


purpose  of  thorough  analysis,  we  therefore  centralize  information 
from  member  states  and  international  partners  in  what  we  call  focal 
points,  including  on  foreign  fighters.  The  information  flow  from 
member  states  and  international  partners,  including  the  U.S.,  has 
significantly  increased  since  the  emergence  of  the  ISIS  threat. 

We  have  now  in  our  headquarters  in  The  Hague  more  than  210 
liaison  officers  coming  from  41  different  countries  and  represent¬ 
ing  74  different  agencies.  That  gives  us  a  huge  opportunity  to  work 
together  closely.  After  the  attacks  in  Paris  and  Brussels,  I  was  able 
also  to  call  up  all  member  states  involved  on  very  short  notice  to 
sit  together  and  to  exchange  information,  including  also  with  U.S. 
partners  like  ICE,  HSI,  or  CBP.  We  set  up  an  emergency  response 
team  at  Europol  to  make  sure  that  we  could  deliver  additional  in¬ 
formation  to  the  ongoing  law  enforcement  investigations.  Directly 
after  the  Paris  attacks,  we  had  more  than  60  people  involved  as 
part  of  an  emergency  response  team.  More  than  one  year  later,  we 
have  on  a  permanent  basis  still  more  than  10  people  working  on 
making  sure  that  all  information  we  receive  on  these  cases  is  cross¬ 
checked,  connected,  assessed,  and  turned  into  new  intelligence.  As 
regards  ICE  HSI  in  particular,  we  have  even  increased  the  extraor¬ 
dinary  cooperation  we  already  had  with  HSI  in  making  sure  that 
all  available  financial  information  and  cross-border  information 
was  brought  to  the  attention  of  agencies  in  Europe  and  the  United 
States,  and  it  delivered  a  very  rich  view  of  those  who  were  involved 
in  and  supporting  this  network.  The  data  Europol  has  is,  I  think, 
our  biggest  added  value.  We  have  more  than  30  million  entities 
in  our  databases,  and  our  data  on  organized  crime  is  particularly 
valuable  because  we’ve  seen  a  very  strong  relationship  between  or¬ 
ganized  crime  and  terrorism. 

CTC:  Can  you  elaborate  on  that  link? 

Van  Gemert:  If  you  look  at  the  Paris  and  Brussels  attackers  and 
their  backgrounds,  there  are  a  lot  of  criminal  links.  This  is  also  a 
feature  of  the  support  networks  behind  ISIS  terrorism  in  Europe. 
We  see  an  increased  interweaving  of  terrorism  and  criminal  activ¬ 
ities.  They  make  use  of  the  same  crime  service  model  as  criminals 
do.  And  that  can  be  an  advantage  to  investigators.  With  the  attacks 
in  Brussels  and  Paris,  it’s  clear  the  attack  network  made  use  of  a 
criminal  service  in  providing  them  identification  documents.  And 
this  means  that  through  a  normal  criminal  investigation  on  fraud¬ 
ulent  documents,  you  could  also  find  very  important  information 
on  terrorism.  The  risk  we  face  is,  to  a  significant  degree,  a  known 
risk  that’s  already  in  our  systems  because  most  of  the  foreign  fight¬ 
ers  from  Europe  had  criminal  backgrounds  before  they  left  for  the 
battlefields. 

CTC:  How  are  HSI  and  Europol  cooperating,  and  what  type  of 
broader  transatlantic  cooperation  are  you  engaged  in? 

Edge:  Traditionally,  our  international  connectivity  with  our  foreign 
partners  had  been  on  a  bilateral  basis.  Ever  since  we  have  assigned 
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agents  and  analysts  to  Europol,  we  have  enjoyed  multilateral  rela¬ 
tionships,  and  we  have  been  able  to  share  the  benefit  of  our  com¬ 
bined  experience  and  investigative  expertise.  That  has  resulted  in 
greater  information  sharing. 

Let  me  give  you  one  example.  What  Wil  mentioned  with  regard 
to  the  sharing  of  financial  information  is  critical  to  every  investi¬ 
gation  and  every  crime  that  we  enforce  against.  HSI  has  built  very, 
very  good  relationships  with  other  industries — both  in  the  private 
sector  and  other  law  enforcement — which  help  us  with  financial 
investigations.  In  the  instance  of  the  horrific  events  in  Brussels  and 
in  Paris,  we  were  able  to  leverage  those  relationships  and  get  that 
information  quickly.  As  Wil  mentioned,  our  strong  links  to  Europol 
afforded  us  the  opportunity  to  then  share  that  information  with  the 
member  states  in  a  very  timely  fashion. 

We  have  also  become  members  of  other  focal  points  that  have  a 
nexus  to  our  mission— including  migrant  smuggling.  To  have  that 
connectivity  in  that  multilateral  environment  has  been  very  helpful. 
I  like  the  way  Wil  put  it— “from  collecting  to  connecting.”  For  years, 
we’ve  always  collected  information,  but  now  thanks  to  enhanced 
information  sharing,  were  connecting  the  dots.  And  that’s  critical 
to  the  public  safety  of  all  of  our  countries. 

Van  Gemert:  I  would  totally  agree  with  Peter.  At  Europol,  we  have 
more  than  200  liaison  officers  who  know  each  other,  work  with 
each  other,  and  speak  one  language— English.  And  we  are  also  the 
go-to  point  for  countries  to  reach  out  to.  While  we  also  see  the  value 
of  bilateral  relationships,  the  experience  we  have  in  cyber  and  now 
also  in  terrorism  has  shown  it’s  necessary  not  only  to  connect  our 
information  flows  but  to  have  operational  meetings  on  a  multilat¬ 
eral  basis.  The  significant  rise  in  the  number  of  U.S.  liaison  officials 
stationed  here  at  Europol  headquarters,  including  very  dedicated 
staff  from  ICE  HSI,  has  really  helped  in  this  regard,  as  have  regular 
visits  and  exchanges  at  the  managerial  and  leadership  levels.  There 
are  now  11  U.S.  agencies  represented  over  here,  taking  part  in  var¬ 
ious  focal  points  and  high-priority  cases.  You  don’t  have  to  send  a 
message  via  cable  and  wait  for  the  answer.  You  just  sit  with  each 
other  and  directly  engage. 

CTC:  Western  counterterrorism  officials  have  sounded  the 
alarm  about  the  large  cohort  of  foreign  fighters  from  Europe 
and  the  West  who  have  trained  in  Syria  and  Iraq.  FBI  Director 
James  Comey  has  warned  that  this  terrorist  diaspora  is  going  to 
be  like  “we’ve  never  seen  before.”1  From  your  perspective,  how 
can  the  United  States  and  Europe  work  together  to  mitigate  the 
threat? 

Van  Gemert:  If  you  look  at  foreign  fighters,  there  will  be  a  window 
of  risk  coming  up  as  the  pressure  increases  on  ISIS.  There  have  been 
between  6,000  and  7,000  foreign  fighters  who  have  traveled  from 
Europe.  Only  a  third  of  them  have  so  far  returned,  so  there’s  the 
possibility  a  lot  more  will  return  as  ISIS  loses  territory.  That  said,  in 
recent  months,  we’ve  not  yet  seen  a  big  exodus  of  European  fighters 
returning  home  from  the  battlefield.  Those  recently  fleeing  back  to 
Europe  have  mostly  been  women  and  children. 

Moving  forward,  we  need  to  interdict  foreign  fighters  on  their 
return  to  Europe  and,  when  appropriate,  charge  them  and  put  them 
on  trial.  With  the  coalition  making  advances  and  taking  ISIS  fight¬ 
ers  into  custody,  we  will  probably  get  more  people  that  can  tell  us 
something  about  those  fighters  who  have  been  active  over  there  and 
will  find  more  forensic  evidence  to  obtain  convictions.  We  also  have 


Peter  Edge  (right)  is  pictured  with  an  HSI  colleague.  (HSI  ICE) 


to  increase  our  capability  to  detect  document  fraud  and  monitor 
travel  to  Europe.  The  European  Counter  Terrorism  Center  (ECTC) 
will  need  to  be  at  the  center  of  these  efforts.  We  have  deployed  guest 
officers  in  Greece  (and  will  do  soon  in  Italy)  that  conduct  secondary 
security  checks  on  those  immigrants  that  give  us  reason  to  double 
check.  These  persons  are  referred  to  us  by  the  local  authorities  and 
border  guards,  which  perform  the  first-line  checks.  We  have  set  up 
diagnostic  tools  that  can  be  used  by  our  border  patrol  officers  to 
look  at  connections  that  could  indicate  whether  a  person  might 
have  intentions  other  than  claiming  asylum. 

But  the  threat  is  actually  not  just  from  foreign  fighters,  because 
ISIS  has  also  tasked  fighters  who  are  from  Syria,  Iraq,  and  other 
non-Western  countries  to  travel  to  launch  attacks.  We  saw  that  in 
the  November  2015  Paris  attacks.  At  Europol,  we  refer  to  these  as 
“tasked  fighters.”  These  are  not  directly  on  our  radar,  and  identi¬ 
fying  them  is  difficult.  And  then  there  are  those  inspired  to  act  as 
a  result  of  ISIS  social  media  or  through  contact  with  the  group. 
We’ve  seen  examples  of  people  becoming  radicalized  in  a  very  short 
period,  going  from  ‘zero  to  hero’  in  six  weeks  or  less,  sometimes 
making  themselves  available  for  attacks  to  atone  for  past  ‘un- Is¬ 
lamic’  behavior. 

All  this  means  the  threat  is  very  broad  and  is  coming  from  very 
different  angles.  Over  the  long-term,  I  think  ISIS  will  be  defeated 
on  the  battlefield,  and  at  least  the  existing  caliphate  will  disappear. 
But  something  will  replace  it.  ISIS  already  has  a  strategy  to  create 
a  cyber  caliphate,  and  more  than  20  groups  around  the  world  have 
pledged  loyalty  to  ISIS.  We’re  seeing  that  to  a  significant  degree  in 
Asia,  including  countries  like  the  Philippines,  so  the  threat  is  likely 
to  come  from  there  as  well  as  the  Middle  East  in  the  future.  All  this 
means  we’re  probably  not  going  to  see  this  threat  going  away  for  de¬ 
cades.  It  will  just  have  a  different  appearance.  It  will  be  focused  es¬ 
pecially  on  reaching  our  communities  through  social  media,  which 
is  why  we  really  try  to  invest  in  counteracting  them  in  this  field. 


Edge:  At  HSI,  we  have  6,700  special  agents,  and  they  are  encour¬ 
aged  to  identify  the  threat  streams  and  smuggling  routes.  They  look 
for  document  fraud  day-to-day.  We  have  seen  more  special-interest 
alien  travel  through  non-traditional  smuggling  routes,  and  just  be¬ 
ing  able  to  identify  those  routes  is  going  to  be  critical.  The  capturing 
of  biographical  information  on  these  actors  through  our  BITMAP 
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program  is  also  going  to  be  very  important.* 

We  have  charged  our  personnel  to  prioritize  focusing  on  illicit 
travel,  including  document  and  benefit  fraud  that  is  utilized  to  fa¬ 
cilitate  foreign  fighter  travel.  We  are  actively  acquiring  information 
on  fraudulent  passports  and  travel  documents.  We  have  a  forensic 
document  lab  that  analyzes  and  processes  this  information  and 
maintains  a  repository  of  hundreds  of  thousands  of  false  passports 
and  other  travel  documents.  I  think  terrorists  traveling  with  false 
papers  will  be  a  big  problem  in  the  future,  and  it’s  going  to  be  critical 
to  identify  them  and  share  that  information  because  these  actors 
typically  go  all  over  the  world. 

As  well  as  looking  at  non-traditional  smuggling  routes,  we  are 
continuing  to  work  to  identify  those  individuals  attempting  to  come 
though  the  prevailing  smuggling  routes.  We  have  a  joint  task  force 
model  in  the  Department  of  Homeland  Security  that  focuses  pri¬ 
marily  on  our  southwest  border,  the  gateway  into  the  United  States 
for  almost  all  illicit  trade,  travel,  and  commerce.  We  are  working 
very  closely  with  our  international  partners  in  South  and  Central 
America  to  encourage  their  law  enforcement  to  work  with  us.  And 
to  that  end,  we’ve  created  transnational  criminal  investigative  units 
in  certain  countries  that  have  helped  us  identify  threat  streams  and 
smuggling  routes  where  people  are  using  false  documents  to  try  to 
transit  into  the  U.S. 

CTC:  More  than  half  the  members  of  the  Islamic  State  terror¬ 
ist  cell  dispatched  from  Syria  that  attacked  Paris  in  November 
2015  and  Brussels  in  March  2016  were  already  on  the  radar 
screen  of  Western  intelligence  agencies.  Yet  they  succeeded  in 
infiltrating  Europe  undetected  in  the  fall  of  2015  by  exploiting 
refugee  flows,  several  by  using  doctored  Syrian  passports.2 
What  lessons  have  been  learned  since  the  Paris  and  Brussels 
attacks? 

Van  Gemert:  A  lot  of  lessons  have  already  been  identified.  One  has 
to  bear  in  mind  that  this  was  part  of  a  huge  immigration  flow  of 
more  than  one  million  people,  in  which  the  systems  were  simply  not 
able  to  function  as  they  should.  If  you  have  5,000  people  coming 
every  day  to  a  Greek  island  as  you  had  in  the  autumn  of  2015,  it’s 
nearly  impossible  to  control  it  completely.  Since  then,  the  European 
Union  has  made  political  agreements  to  control  the  flow. 

We’re  working  to  identify  indicators  that  can  be  used  in  train¬ 
ing  and  guiding  our  border  patrol  officers  to  check  identity  papers 
better.  As  mentioned  earlier,  we’re  doing  secondary  security  checks 
and  have  set  up  “hotspot  teams”  at  various  entry  points  in  the 
Mediterranean.  This  means  Europol  staff  and  guest  officers  from 
E.U.  member  states  coordinated  by  Europol  are  present  in  refugee 
camps  on  5  Greek  islands  identified  as  “hotspots”  on  the  migration 
routes  to  Europe.  All  migrants  arriving  on  these  islands  are  taken 
to  these  camps  after  arriving  onshore.  Within  the  camps,  additional 
security  checks  take  place  against  our  databases  if  there  is  some 
form  of  suspicion  regarding  a  migrant’s  background  or  motivation. 

All  these  activities  are  part  of  Europol’s  European  Counter  Ter¬ 
rorism  Center,  which  was  set  up  after  the  Paris  attacks.  It  brings  to¬ 


a  Biometric  Identification  Transnational  Migration  Alert  Program  (BITMAP) 
is  an  HSI-led  initiative  that  fills  biometric  databases  with  data  collected 
from  special  interest  aliens,  violent  criminals,  fugitives,  and  confirmed 
or  suspected  terrorists  encountered  within  illicit  pathways.  This  data 
helps  HSI  form  strategic  pictures  of  the  trends,  networks,  and  individuals 
connected  with  these  pathways. 


Wil  van  Gemert  (Europol) 


gether  in  one  place  all  of  Europol’s  CT  tools  in  order  to  enhance  our 
role  as  the  E.U.  information  hub  on  CT  matters  and  to  deliver  oper¬ 
ational  support  and  analysis  to  E.U.  member  states’  CT  investiga¬ 
tions,  drawing  on  Europol’s  unique  capabilities  relating  for  example 
to  terrorist  financing,  firearms,  or  online  propaganda.  At  the  heart 
of  ECTC  is  a  Joint  Liaison  Team  with  dedicated  CT  investigators 
from  E.U.  member  states  and  selected  international  partners  such 
as  the  U.S.  These  CT  experts  are  specifically  deployed  to  Europol  for 
the  purpose  of  enhancing  European  cooperation  in  counterterror¬ 
ism  matters.  Enhancing  information  exchange  on  Foreign  Terrorist 
Fighters  or  on  the  criminal  support  networks  for  terrorist  structures 
are  just  some  of  the  specific  projects  currently  on  the  operational 
agenda  in  the  fight  against  terrorism  on  the  European  level. 


CTC:  Just  to  follow  up,  Europol  Director  Wainwright  recently 
stated,  “ISIL  are  in  the  business  of  getting  their  people  back 
into  Europe  in  increasingly  sophisticated  ways,”  which  includes 
obtaining  high-quality,  false  travel  documents.3  As  early  as 
2015,  HSI  raised  concerns  about  the  Islamic  State  acquiring 
blank  passports  and  passport-printing  machines  in  Syria.4  Giv¬ 
en  that  the  Islamic  State  has  been  able  to  create  identity  papers 
for  its  operatives  from  real  Syrian  passports, b  how  are  security 
agencies  working  to  verify  those  claiming  asylum  in  Europe  are 
who  they  say  they  are? 

Edge:  The  2015  report  illustrates  the  need  for  our  continued  efforts 
to  identify  and  address  potential  vulnerabilities  as  they  pertain  to 


b  Editor’s  note:  Interpol  has  data  on  250,000  lost  or  stolen  Syrian  and  Iraqi 
passports,  including  blanks.  The  Paris  attack  cell  and  a  trio  of  Syrians 
arrested  in  Germany  in  September  2016  appear  to  have  been  supplied 
with  doctored  Syrian  passports  by  the  same  forger,  according  to  German 
officials.  A  significant  number  of  the  Islamic  State  operatives  who  have 
infiltrated  Europe  have  come  in  using  doctored  Syrian  passports.  At 
least  two  of  the  Paris  attack  network  reportedly  had  adulterated  Syrian 
passports,  which  were  part  of  a  batch  of  3,800  blank  Syrian  passports 
obtained  by  the  Islamic  State  in  Raqqa  and  Deir-ez-Zour.  These  were 
reportedly  flagged  to  Interpol  by  the  Syrian  regime  well  before  the  Paris 
attacks:  Giulia  Paravicini,  “EU’s  passport  fraud  'epidemic,'”  Politico,  January 
28, 2016;  Euan  McKirdy,  Stephanie  Halasz,  and  Jason  Hanna,  ‘‘Germany:  3 
alleged  ISIS  members  arrested  in  Paris  attacks  probe,"  CNN,  September  13, 
2016;  Manuel  Bewarder  and  Florian  Flade,  “Die  geheimen  Reisen  des  BND 
nach  Damaskus,”  Die  Welt,  May  29,  2016. 
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terrorist  travel.  The  acquisition  of  documents  through  fraudulent 
means  is  what  worries  me  the  most,  and  we  are  going  to  have  to 
continue  to  address  it  by  working  with  our  European  counterparts 
on  the  Turkey,  Greece,  and  Balkan  routes.  HSI  collects  relevant  in¬ 
formation  within  our  core  mission  spaces  of  document  and  benefit 
fraud,  and  we  share  that  information  through  our  investigative  and 
liaison  activities  to  ensure  our  partners  are  aware  of  the  potential 
threats  we  identify.  HSI  works  with  the  Department  of  State  and 
other  federal  agencies  to  share  biometric  and  biographical  infor¬ 
mation  on  potential  travelers.  Visa  and  other  applicants  to  the  U.S. 
are  vetted  both  biometrically  and  biographically.  Individuals  de¬ 
nied  nonimmigrant  visas  based  on  severe  derogatory  information 
are  watch-listed.  Lost  or  stolen  passports  are  flagged  and  checked 
across  various  datasets  to  include  asylum  information.  Finally,  the 
HSI  Forensic  Laboratory  conducts  forensic  examinations  of  Syrian 
passports  to  determine  authenticity.  The  laboratory  has  produced  a 
document  alert  and  Syrian  document  reference  guide  to  assist  law 
enforcement  and  border  control  authorities  in  the  identification 
of  fraudulent  Syrian  passports.  This  information  is  disseminated 
to  partners  worldwide,  including  to  European  counterparts.  These 
reference  products  are  based  on  information  developed  from  fo¬ 
rensic  examinations  of  Syrian  passports  and  received  through  law 
enforcement  channels,  but  the  lack  of  reliable  information  from 
the  issuing  government  limits  what  can  be  disseminated  to  field 
officers. 

Also,  from  the  U.S.  perspective,  we’ve  got  to  do  more  in  the  con¬ 
tinent  of  Africa.  We  need  to  work  closer  with  our  law  enforcement 
partners  in  Africa  to  identify  places  where  these  folks  will  go  for 
training  and  then  will  begin  their  illicit  travel  from.  At  HSI,  leverag¬ 
ing  our  intelligence  portfolio  and  our  international  partnerships  is 
going  to  be  critical  to  identify  the  smuggling  and  document  forgery 
networks  used  by  foreign  fighters.  They’re  ever-evolving.  It’s  going 
to  take  cooperation  again  through  the  law  enforcement  partners 
we  have  around  the  world  to  identify  those  smuggling  routes,  share 
that  information,  and  connect  the  dots  of  the  biometric  information 
and  the  biographical  information  available  to  us. 

Van  Gemert:  And  I  should  add  we  can  certainly  learn  from  one 
another  across  the  Atlantic  when  it  comes  to  improving  vetting  pro¬ 
cedures.  When  it  comes  to  identifying  document  fraud,  information 
is  key,  including  extracting  information  from  documents  recovered 
from  the  battlefield.  They  could  provide  the  key  informational  links 
in  identifying  travelers  that  were  unknown  or  give  indications  on 
travel  documents  that  could  be  used  by  returnees  and  attackers. 

In  identifying  document  fraud  and  other  efforts  to  track  foreign 
fighters,  one  thing  we  need  to  do  better  in  Europe  is  connect  the 
dots  between  information  developed  by  law  enforcement  agencies 
in  criminal  investigations  and  by  intelligence  agencies  in  national 
security  investigations.  This  is  the  discussion  we  are  now  having 
in  Europe:  how  do  we  do  this  in  a  proper  way,  how  to  make  sure 
that  we  have  the  right  watch  list  that  is  fed  not  only  by  intelligence 
services  but  also  by  law  enforcement,  and  how  to  make  sure  infor¬ 
mation  is  flowing  between  the  two.  And  that’s  still  something  that 
we  are  getting  better  at  but  have  not  solved. 

CTC:  There  has  been  concern  that  the  visa  waiver  program 
between  the  United  States  and  Europe  could  be  exploited  by 
European  extremists  or  terrorist  recruits  to  enter  the  United 


States.'  How  are  the  United  States  and  Europe  working  togeth¬ 
er  to  mitigate  risk  in  this  area? 

Edge:  One  of  the  things  that  is  going  to  be  critical  is  being  able  to 
identify  asylum  fraud,  a  pervasive  problem.  Smuggling  networks 
are  using  false  documents  to  transport  special-interest  aliens  from 
Europe  into  countries  in  the  Western  Hemisphere  on  a  routine 
basis.  But  there  is  actually  a  technological  fix  to  the  whole  issue 
of  document  fraud.  Key  to  clamping  down  on  illicit  travel  will  be 
greater  use  of  biometrics,  and  we  are  already  moving  in  this  direc¬ 
tion.  More  widespread  use  of  biometric  passports  will  make  our  visa 
security  program  much  more  comprehensive.  It  will  help  us  verify 
exactly  who  we’re  dealing  with  and  then  share  and  cross-check  that 
information  with  our  counterparts  at  Europol. 

CTC:  Given  the  potentially  significant  economic  costs  and 
logistical  challenges,  how  far  away  are  we  from  the  biometric 
fix? 

Edge:  At  present,  neither  Syria  nor  Iraq  issues  electronic  passports.1* 
While  technical  solutions  have  enhanced  the  ability  to  recognize 
document  fraud,  there  are  also  inherent  limitations.  The  lack  of 
interoperability,  resources,  funding,  and  technological  limitations 
have  presented  challenges  for  implementation.  In  addition,  these 
solutions  do  not  address  the  ability  of  persons  obtaining  genuinely 
issued  documents  via  fraudulent  means. 

Technological  solutions  are  an  important  component  in  verify¬ 
ing  the  integrity  of  the  traveler  and  his/her  associated  legitimate 
travel  document.  To  date,  through  DHS’  Secure  Real-Time  Plat¬ 
form,  we  have  vetted  over  300,000  immigration  applications  for 
international  partners,  helping  them  to  identify  potential  travel 
by  known  or  suspected  terrorists.  We  have  also  recently  begun  to 
compare  select  refugee  applications  and  enforcement  cases  against 
foreign  data. 

However,  revisiting  themes  I  referenced  earlier,  we  have  seen 
situations  where  this  is  still  only  a  partial  solution.  For  techno¬ 
logical  solutions  to  be  effective,  any  country  that  could  be  used 
to  further  illicit  travel  must  have  the  capability  to  scan  biometric 
passports  and  identity  cards.  Deploying  the  feature  in  travel  doc¬ 
uments  and  having  the  interoperable  capacity  to  use  them  are  two 
different  things.  For  example,  we  have  seen  smuggling  networks  use 
authentic  documents  acquired  through  theft  or  purchase  to  enter 
the  Western  Hemisphere.  The  networks  will  push  use  of  legitimate 


c  Editor's  note:  In  the  more  than  25-year  period  of  the  visa  waiver  program, 
there  have  been  around  300  million  entries  into  the  United  States,  but 
according  to  RAND  terrorism  researcher  Brian  Jenkins,  only  three  Islamist 
terrorists  have  reached  the  United  States  by  plane  from  the  countries 
concerned.  Brian  Michael  Jenkins,  “Inspiration,  Not  Infiltration:  Jihadist 
Conspirators  in  the  United  States,”  testimony  presented  before  the  House 
Oversight  and  Governmental  Reform  Committee,  December  10, 2015,  pp. 
5-6;  Jenkins  email  to  CTC  Sentinel,  January  2017. 

d  Editor’s  note:  Electronic  passports  (also  known  as  e-passports)  issued 
by  the  United  States  and  countries  belonging  to  the  Visa  Waiver  Program 
contain  a  “biometric  identifier,"  with  the  United  States  requiring  that  the 
chip  contain  a  digital  photograph  of  the  holder.  The  United  States  requires 
that  travelers  entering  the  United  States  under  the  Visa  Waiver  Program 
have  an  e-passport  if  their  passport  was  issued  on  or  after  October  26, 
2006.  British  e-passports  contain  the  holder's  "facial  biometric,”  and  facial 
recognition  software  is  deployed  at  e-passport  gates  at  all  major  airports  in 
the  United  Kingdom.  See  Department  of  Homeland  Security,  “E-Passports;” 
HM  Passport  Office,  “Guidance:  Biometric  passports  and  passport  readers,” 
August  8, 2016;  NIDirect,  “Using  ePassport  gates  at  airport  border  control.” 
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travel  systems  to  the  fullest  extent  possible  to  realize  efficiencies, 
but  will  incorporate  smuggling  and  fake  documents  as  necessary  to 
evade  screening  and  border  controls  until  finally  approaching  the 
U.S.  southwest  border  and  declaring  asylum. 

Van  Gemert:  I  agree  greater  introduction  of  biometrics  will  really 
help  us  in  identifying  who  is  really  traveling.  In  Europe,  all  Schen¬ 
gen  countries  are  obliged  to  include  biometrics  in  all  new  passports 
since  2006  (facial  image)  and  2009  (fingerprints).  But  it  will  take  a 
long  transition  time,  of  course,  until  all  passport  holders  have  new 
passports  with  these  features.  Just  to  put  it  in  perspective,  the  E.U. 
has  500  million  inhabitants  and  28  member  states. 

In  the  meantime,  we  need  to  make  better  use  of  the  tools  already 
in  place,  and  we  need  to  work  to  create  a  legal  architecture  better 
equipped  to  deal  with  the  threat.  Data  protection  requirements  at 
the  time  of  the  November  2015  Paris  attacks  created  separations 
between  the  different  European  systems  we  were  using  such  as  the 
Schengen  Information  System  and  the  Visa  Information  System 
and  systems  we  use  at  Europol.  And  when  politicians  ask  us,  “Why 
are  these  systems  not  aligned  with  each  other?  Why  is  this  not 
happening?”  the  answer  is  “that’s  because  there  was  a  conscious 
political  decision  in  the  past  not  to  align  these  systems,  which  were 
built  for  different  purposes.”  I  think  there’s  a  common  political  un¬ 
derstanding  now  in  the  European  Union  on  the  need  to  remove 
such  legal  barriers  and  to  create  better  interoperability  between  the 
different  information  systems. 

CTC:  Concerns  have  been  expressed  that  the  Islamic  State  op¬ 
eratives  may  seek  to  gain  entry  into  the  United  States  hy  ex¬ 
ploiting  refugee  flows  from  Syria  and  elsewhere.6  What  is  being 
done  by  DHS  to  mitigate  risk  in  this  area? 

Edge:  DHS  is  certainly  doing  its  part  to  address  the  Syrian  ref¬ 
ugee  crisis.  Citizenship  and  Immigration  Services  in  conjunction 
with  the  Department  of  State  is  doing  most  of  the  work  in  that 
space.  They’ve  admitted  more  than  10,000  Syrian  refugees  in  this 
fiscal  year  alone.  All  these  refugees,  including  the  Syrians,  have 
been  admitted  only  after  completing  a  series  of  stringent  securi¬ 
ty  and  screening  and  vetting  processes.  Security  checks  have  been 
implemented,  as  well  as  categorizing  them  as  frequent  travelers  or 
infrequent  travelers.  HSI  has  been  included  in  the  vetting  process 
from  a  criminal  investigative  perspective  and  has  provided  all  the 
information  we  have  acquired  to  the  lead  agencies. 


e  Editor’s  note:  In  2015,  the  National  Counterterrorism  Center  (NCTC) 
informed  Congress  that  it  had  identified  “individuals  with  ties  to  terrorist 
groups  in  Syria  attempting  to  gain  entry  to  the  U.S.  through  the  U.S.  refugee 
program.”  The  U.S.  government  has  resettled  about  12,000  Syrian  refugees 
in  the  United  States  since  the  Syrian  civil  war  began,  around  80  percent 
of  whom  are  women  and  children.  Some  American  law  enforcement 
and  intelligence  officials  have  said  there  are  informational  black  holes 
creating  challenges  in  screening  such  refugees.  There  have  been  no 
publicly  identified  cases  of  refugees  from  the  Syrian  civil  war  charged  with 
terrorism  offenses  in  the  United  States.  Haeyoun  Park  and  Rudy  Omri,  “U.S. 
Reaches  Goal  of  Admitting  10,000  Syrian  Refugees.  Here’s  Where  They 
Went,”  New  York  Times,  August  31,  2016.  “McCaul  Statement  on  Concerns 
Regarding  Syrian  Refugee  Program,"  Homeland  Security  Committee, 
December  7, 2015;  Jared  Goyette,  “Most  Syrian  refugees  coming  to  U.S. 
are  women,  children,”  USA  Today,  August  9,  2016;  “The  ISIS  Terror  Threat  in 
America,”  Majority  Staff,  Homeland  Security  Committee,  November  2016; 
“Nation’s  Top  Security  Officials’  Concerns  on  Refugee  Vetting,”  Majority 
Staff,  Homeland  Security  Committee,  November  19,  2015. 


CTC:  The  numbers  of  irregular  migrants  entering  Europe 
through  the  Turkey-Greece-Balkan  route  sharply  dropped  this 
year.  Given  the  Islamic  State  was  able  to  exploit  the  fall  2015 
migrant  crisis  to  infiltrate  operatives  into  Europe,  what  kind 
of  contingency  planning  has  been  done  to  prevent  a  reoccur¬ 
rence  of  this  infiltration  in  case  there  is  a  future  surge  in  the 
numbers? 

Van  Gemert:  With  everything  in  place  now,  with  the  E.U.’s  coor¬ 
dinated  efforts  in  the  migration  hotspots,  with  the  support  we  are 
delivering  to  frontline  countries  like  Greece  and  Italy,  and  with  im¬ 
provements  in  our  capability  to  quickly  react,  I  think  that  even  if 
there  were  an  opening  of  the  borders  again,  there  would  be  a  bet¬ 
ter  response  than  in  late  2015  and  early  2016  because  we’re  better 
prepared.  But  still,  this  would  be  a  big  issue  for  us,  and  it  would  be 
something  that  would  need  to  be  solved  on  the  political  level  rather 
than  just  by  police  or  law  enforcement. 

CTC:  How  useful  have  the  thousands  of  registration  documents 
and  other  documents  recovered  from  the  Islamic  State5  been  in 
identifying  Westerners  who  have  joined  the  Islamic  State  and 
other  terrorist  groups  in  Syria  and  Iraq? 

Edge:  The  registration  documents  have  been  critical  to  our  ability 
to  analyze  the  travel  of  the  Westerners  who  have  joined  the  Islam¬ 
ic  State.  So  that  has  been  something  that  has  been  very,  very  im¬ 
portant  to  us.  From  the  perspective  of  HSI,  it’s  also  important  to 
note  that  ISIS  has  demonstrated  the  capability  to  exploit  a  lot  of 
travel-related  vulnerabilities,  which  means  we  need  to  continue  to 
leverage  our  resources  to  acquire  information,  including  informa¬ 
tion  obtained  by  the  United  States  from  the  battlefield,  and  share  it 
through  Europol.  One  of  the  things  that  has  been  critically  helpful 
to  us  and  something  that  we’re  earnestly  investing  in  is  analyzing 
social  media  linked  to  foreign  fighters  to  see  what  they’re  saying  to 
each  other  and  what  sources  of  information  they’re  accessing  so 
that  we  can  stay  two  steps  ahead  of  them  as  they  are  traveling  the 
world  and  can  make  the  appropriate  notifications  to  our  partners. 

Van  Gemert:  I  agree  that  the  registration  documents  and  other 
battlefield  intelligence  has  been  critical.  Convictions  in  criminal 
trials  for  returning  fighters  require  proof  and  these  kinds  of  docu¬ 
ments  are  essential  in  that  regard. 

I  have  the  same  view  on  the  importance  of  social  media  analysis 
as  Peter.  The  biggest  innovation  I’ve  seen  in  the  last  year  at  Europol 
was  our  emphasis  on  social  mediaand  open  sourcemonitoring.This 
has  resulted  in  a  better  understanding  of  foreign  fighters  and  the 
smuggling  and  financial  networks  they  are  accessing.  The  biggest 
added  value  in  my  view  is  improving  understanding  of  how  ISIS 
uses  social  media  and  being  able  to  analyze  the  social  media  pres¬ 
ence  of  a  target  including  identifying  his  network  and,  in  that  way, 
being  able  to  create  a  cyber  profile  next  to  the  target’s  regular  re¬ 
al-life  profile,  which  generally  delivers  very  useful  new  information 
to  investigators. 

Another  important  tool  for  us  is  Europol’s  internet  referral  unit,6 
which  detects  terrorist  and  violent  extremist  online  content,  flags 
and  refers  such  content  to  internet  providers,  and  asks  for  its  re- 
moval.The  referrals  are  made  to  platforms  like  Twitter  or  Facebook 
notifying  them  that  particular  content  is  in  conflict  with  their  own 
terms  of  service,  after  which,  in  90  percent  of  the  cases,  the  content 
is  removed  by  the  company  itself. 
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Fighting  the  Long  War:  The  Evolution  of 
al-Qa  'ida  in  the  Arabian  Peninsula 

By  Michael  Horton 


The  civil  war  in  Yemen  is  providing  an  ideal  operational 
environment  for  al-Qa'ida  in  the  Arabian  Peninsula 
(AQAP).  The  war  has  acted  as  a  catalyst  for  the 
organization’s  evolution.  AQAP  is  now  focused  on 
implementing  a  more  covert  strategy  that  allows  it 
to  expand  its  ties  to  local  communities  and  to  further 
enmesh  itself  within  some  forces  battling  the  Houthis 
and  their  allies.  These  deepening  ties  with  local 
communities  and  anti-Houthi  forces  mean  that  AQAP 
will  be  even  more  resilient  and  more  difficult  to  combat. 


The  civil  war  in  Yemen  has  been  a  gift  to  al-Qa '  ida  in  the 
Arabian  Peninsula  (AQAP)-  AQAP,  like  all  insurgent 
groups,  thrives  in  environments  where  state  authority 
is  weak  or  non-existent,  where  poverty  is  endemic,  and 
where  opposition  forces  are  fragmented.  The  months 
of  unrelenting  war  in  Yemen  have  amplified  all  of  these  conditions. 
AQAP  is  honing  and  refining  its  capabilities  in  multiple  areas,  and 
in  what  is  a  dangerous  parallel  with  Syria,  it  is  deepening  its  ties 
to  local  communities  and  enmeshing  itself  within  the  groups  that 
oppose  Yemen’s  Houthi  rebels  and  their  allies. 

Yemen’s  political  landscape  is  as  complex  and  unforgiving  as  its 
rugged  terrain.  The  country’s  civil  war  mirrors  this  complexity.  The 
civil  war  is  not  being  fought  by  two  parties  but  rather  by  multiple 
groups  whose  loyalties  are  often  fluid.  The  war  has  drawn  in  outside 
powers,  most  notably  Saudi  Arabia  and  the  United  Arab  Emirates 
(UAE),  that  are  backing  Yemen’s  internationally  recognized  gov¬ 
ernment  in  its  fight  against  Yemen’s  Houthi  rebels.  The  Houthis,  a 
predominantly  Zaidi  Shi '  a  revivalist  movement,  are  currently  al¬ 
lied  with  former  Yemeni  president  Ali  Abdullah  Saleh  along  with  a 
significant  portion  of  the  Yemeni  Army  that  has  remained  loyal  to 
the  former  president. 

In  March  2015,  Saudi  Arabia  and  its  coalition  partners  launched 
“Operation  Decisive  Storm,”  a  military  campaign  that  was  ostensibly 
designed  to  defeat  the  Houthis  and  reinstall  Yemen’s  government  in 
exile,  led  by  President  Abd-Rabbu  Mansour  Hadi.  While  the  cam¬ 
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Jamestown  Foundation  where  he  specializes  in  Middle  Eastern 
affairs  with  a  particular  focus  on  Yemen.  He  is  a  frequent 
contributor  to  Jane’s  Intelligence  Review  and  has  written  for 
numerous  publications  including  Islamic  Affairs  Analyst,  The 
Economist,  The  National  Interest,  and  The  Christian  Science 
Monitor.  He  has  completed  numerous  in-depth,  field-based 
studies  in  Yemen  and  Somalia  on  topics  ranging  from  prison 
radicalization  to  insurgent  tactics,  techniques,  and  procedures. 


paign  has  thus  far  failed  to  achieve  its  aims,  it  has  helped  create  an 
ideal  operational  space  for  AQAP,  one  of  al-Qa  ida’s  most  nimble 
and  resilient  franchises.  AQAP  acted  decisively  to  fill  the  power  vac¬ 
uum  left  by  the  unraveling  of  Yemen’s  Armed  Forces  (YAF)  and  its 
limited  state  structures.  While  AQAP  is  no  longer  overtly  holding 
territory,  the  organization’s  influence  and  operational  reach  extend 
across  much  of  southern  Yemen.1 

AQAP,  which  is  now  better  funded  and  armed  than  at  any  point 
in  its  history,11  has  implemented  a  three-point  strategy.  First,  AQAP 
has  realized  that  it  cannot  alienate  those  it  seeks  to  govern  by  en¬ 
forcing  all  aspects  of  its  understanding  of  Islamic  law.  It  is  thus 
demonstrating  its  capacity  to  ‘govern’  and  provide  basic  services, 
most  particularly  security.  Second,  AQAP  is  deepening  its  ties 
with  Yemen’s  tribes  whose  power  has  been  enhanced  by  the  civil 
war.  Third,  AQAP  is  enmeshing  itself  within  some  of  those  forces 
fighting  against  the  Houthis  and  their  allies.  Concurrent  with  this 
three-point  strategy  and  in  support  of  it,  AQAP  is  working  to  fur¬ 
ther  develop  its  intelligence  and  counterintelligence  cells.  It  is  also 
developing  its  capacity  to  utilize  what  can  be  termed  semi-conven- 
tional  tactics  on  the  battlefield.11 

Lessons  Learned 

The  popular  uprising  against  Saleh  in  2011  provided  AQAP  with 
an  operational  environment  that  was  not  too  different  from  the  one 
that  now  exists  in  large  parts  of  southern  Yemen.  The  contested 
uprising  against  Saleh — who  remained  popular  with  many  Yeme¬ 
nis— sowed  dissent  within  the  YAF.2  The  dissent  within  the  Yemeni 
Army  and  the  removal  of  key  units  from  vulnerable  parts  of  south¬ 
ern  Yemen  left  a  void  that  AQAP  quickly  filled.  By  March  2011, 
AQAP  was  in  control  of  large  parts  of  the  governorates  of  Abyan 
and  Shabwa  and  declared  the  formation  of  an  Islamic  emirate  in 
parts  of  both  governorates.3  In  late  May  2011,  AQAP,  which  by  then 
had  begun  referring  to  parts  of  its  organization  as  Ansar  al-Sharia, 
seized  the  town  of  Zinjibar,  the  capital  of  Abyan.  AQAP  was  able 
to  maintain  control  of  parts  of  Abyan  and  Zinjibar  until  May  2012 
when  a  successful  offensive  was  launched  by  a  combination  of  Ye¬ 
meni  Army  units  and  tribal  militias  that  were  carefully  aided  by  the 
United  States.4 

AQAP’s  seizure  of  Zinjibar  and  the  surrounding  areas  provided 
it  with  its  first  opportunity  to  hold  and  ‘govern’  a  territory.  While 


a  This  observation  by  the  author  is  based  on  numerous  interviews  with 
observers  of  al-Qa'ida  in  Yemen  as  well  as  open  source  information. 

b  The  Yemeni  Armed  Forces,  in  particular  the  Yemeni  Army,  have  never  been  a 
particularly  cohesive  fighting  force.  Many  units  were  and  are  administered 
like  personal  fiefdoms  by  their  commanding  officers,  where  soldiers 
frequently  view  orders  from  their  commanders  as  suggestions  rather  than 
orders.  Many  units  up  to  the  brigade  level  are  organized  according  to  tribal 
affiliations  with  ‘stronger’  tribes  being  assigned  to  the  better-funded  and 
better-equipped  units. 
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AQAP  was  eventually  forced  out  of  the  governorate  with  heavy  loss¬ 
es,  the  year  in  which  it  controlled  the  area  was  instructive.  AQAP’s 
reign  over  parts  of  Abyan  and  Shabwa  was  an  experiment  in  which 
its  leadership  was  able  to  test  how  far  it  could  go  in  imposing  its 
interpretation  of  Islamic  law.  During  this  period,  AQAP’s  leader¬ 
ship  was  divided  among  those  who  favored  a  maximalist  approach, 
which  involved  enforcing  all  aspects  of  its  version  of  sharia  law,  and 
the  gradualists,  who  favored  a  step-by-step  approach.5  c  For  most 
of  the  year  in  which  it  ruled  over  Abyan,  AQAP  pursued  more  of 
a  maximalist  approach  by  introducing  the  Islamic  penal  code  and 
irregularly  enforced  a  ban  on  the  widely  used  mild-narcotic  qat.d 

Most  critically,  AQAP’s  version  of  sharia  law  in  many  cases  su¬ 
perseded  tribal  law,  which  is  relied  upon  to  settle  disputes  between 
tribal  members.  This  undermined  the  authority  of  tribal  law  and  of 


c  There  is  an  ongoing  debate  among  AQAP's  relatively  diffuse  leadership 
about  how  critical  tribal  allies  are,  which  also  impacts  arguments  about 
how  flexible  AQAP  should  be  when  it  comes  to  enforcing  its  understanding 
of  sharia  and,  more  broadly,  how  it  governs.  AQAP's  current  leader,  Qasim 
al-Raymi,  worked  closely  with  AQAP’s  former  leader  Nasir  al-Wuhayshi  who 
advocated  for  a  gradualist  approach  to  governance.  It  is  likely  that  al-Raymi 
shares  at  least  some  of  al-Wuhayshi's  ideas  about  how  to  engage  with  local 
populations.  However,  it  should  also  be  noted  that  al-Raymi  referred  to  the 
United  States  in  late  2015  as  the  ‘primary  enemy.' This  view,  if  still  held,  will 
have  to  be  balanced  against  AQAP’s  very  local  battle  against  the  Houthis 
and  their  allies.  Thomas  Joscelyn,  “AQAP  Leader  says  America  is  the 
‘Primary  Enemy,”’  Long  War  Journal,  December  24,  2015. 

d  Reports  from  residents  of  the  towns  of  Jaar  and  Zinjibar  reflect  the  variance 
of  AQAP’s— or  Ansar  al-Sharia’s— approach  to  enforcing  Islamic  law  and  the 
ban  on  qat.  in  some  areas  under  the  control  of  AQAP,  all  aspects  of  Islamic 
law  were  rigorously  enforced  while  in  other  areas  AQAP  was  more  tolerant. 
With  qat  in  particular,  AQAP’s  willingness  to  enforce  varied  over  the  months 
in  which  it  ruled  parts  of  Abyan.  While  qat  is  not  as  popular  in  southern 
Yemen  as  it  is  in  the  north,  it  is  still  used  by  a  significant  percentage  of  the 
population,  and  most  critically,  the  trade  in  qat  is  the  only  lucrative  source 
of  employment  in  many  areas. 


tribal  leaders  who  were  not  prepared  to  cede  authority  to  men  who 
were  not  from  the  area,  not  members  of  local  tribes,  and— in  some 
cases— were  not  even  Yemeni.6 

AQAP  also  attempted  to  implement  public  works  programs. 
It  refurbished  a  number  of  water  wells,  fixed  damaged  streets,  re¬ 
paired  water  mains,  and,  in  the  early  months  of  its  control  over  the 
governorate,  provided  limited  food  aid  to  the  poorest  residents— 
though  always  with  strings  attached.6  f  However,  as  the  organization 
came  under  pressure  during  the  early  months  of  2012,  it  became 
far  less  concerned  with  meeting  the  needs  of  the  population  it 
claimed  to  govern.  It  increasingly  targeted  tribal  figures  deemed 
to  be  non-compliant. 

More  than  anything,  AQAP’s  harsh  approach  to  governance 
cost  it  its  gains  in  Abyan  and  paved  the  way  for  a  serious— if  tem¬ 
porary-defeat.  In  May  2012,  the  YAF,  supported  by  elements  of 
the  United  States  Armed  Forces,  launched  an  offensive  that  relied 
heavily  on  tribal  militias.7  The  support  of  these  militias  proved  crit¬ 
ical  to  the  defeat  of  AQAP-  Tribal  militias  provided  intelligence  on 
AQAP’s  positions,  movements,  weapons  caches,  and  escape  routes. 


e  In  2011  and  2012,  AQAP  had  a  significant  number  of  fighters  from  Somalia 
and  of  Somali  descent.  Coastal  Abyan  and  Aden  are  home  to  large  numbers 
of  Somali  refugees  and  second-  and  third-generation  immigrants  from 
Somalia.  AQAP's  use  of  foreign  fighters  proved  to  be  highly  problematic  in 
the  non-coastal  and  more  ‘tribal’  parts  of  Abyan.  It  has  been  the  author’s 
observation  that  a  significant  number  of  Yemenis— especially  those  living 
in  the  north  and  more  mountainous  areas— are  quite  racist  when  it  comes 
to  Africans.  AQAP's  fighters  of  Somali  descent  were  subject  to  summary 
execution  when  caught  by  tribal  militias.  Author  interviews,  various  Yemeni 
tribal  engagement  officers,  2012-2013. 

f  As  conditions  deteriorated  in  Abyan  in  2012,  AQAP  made  the  provision  of 
food  and  other  items  dependent  on  a  community’s  willingness  to  provide 
recruits  for  AQAP.  These  recruits— most  of  them  forced— were  regarded 
by  AQAP  as  unreliable  and  therefore  largely  expendable.  Thus,  they  were 
frequently  used  as  decoys  and  in  suicide  operations. 
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In  a  period  of  weeks,  AQAP  went  from  a  high  level  of  operational 
freedom  to  fleeing — often  on  foot — either  singly  or  in  small  bands.8 

AQAP’s  defeat  did  not  go  unanalyzed  by  its  leadership.  In  May 
and  August  of  2012,  Nasir  al-Wuhayshi,  the  late  leader  of  AQAP, 
penned  two  letters  to  his  counterpart  in  al-Qa'ida  in  the  Islam¬ 
ic  Maghreb  (AQIM).9  In  these  letters,  al-Wuhayshi  claimed  that 
AQAP  was  not  defeated  but  had  staged  a  strategic  withdrawal.  In 
the  same  letters,  he  warned  his  counterpart  to  adopt  a  gradualist 
approach  to  implementing  Islamic  law.  Al-Wuhayshi  also  wrote 
that  local  tribes  were  AQAP’s  most  formidable  enemies  and  the 
greatest  obstacle  to  it  maintaining  control.  Some  of  AQAP’s  lead¬ 
ers  realized  that  to  be  successful,  at  least  over  the  long-term,  they 
must  have  abiding  local  support.10  Apart  from  some  coastal  areas, 
this  support  is  contingent  on  successfully  engaging  with  Yemen’s 
tribal  leaders.  Yet,  many  ofYemen’s  tribes  are  quite  democratic  and 
resist  top-down  authority,  especially  when  those  trying  to  assert 
their  authority  are  outsiders.11 

A  New  Approach  to  Tribal  Engagement 

Following  AQAP’s  expulsion  from  Abyan  and  parts  of  Shabwa  in 
2012,  many  of  its  members  fled  to  the  mountain  redoubts  of  the 
governorate  of  al-Bayda,  where  AQAP  has  long  maintained  a  pres¬ 
ence.12  Since  antiquity,  this  strategic  area  has  been  contested  be¬ 
cause  it  is  a  gateway  from  the  southern  coast  to  Yemen’s  central 
highlands.  The  clans  and  tribes  of  al-Bayda  are  particularly  frac¬ 
tious  and  extractive.  The  divided  nature  of  its  tribes  has  meant  that 
AQAP  has  had  more  success  penetrating  al-Bayda’s  tribal  matrix 
than  elsewhere  in  Yemen.  AQAP  and  its  earlier  iterations  had  tried 
and  largely  failed  to  secure  the  enduring  support  of  cohesive  and 
insular  tribes  in  other  parts  of  Yemen,  such  as  the  governo rates  of 
Marib  and  al-Jawf.18 

Al-Bayda  is  different.  Here,  AQAP  exploited  inter-tribal  rivalries 
by  leveraging  its  access  to  arms,  funds,  and  the  military  acumen  of 
some  of  its  ranking  members  in  exchange  for  safe  havens.  In  2012 
and  2013,  AQAP  inserted  itself  into  one  of  al-Bayda’s  inter-tribal 
feuds  by  backing  Tareq  al-Dhahab,  a  ranking  member  of  the  Dha- 
hab  clan  who  had  been  passed  over  for  a  leadership  position  with¬ 
in  the  locally  powerful  Qayfa  tribe.14  However,  the  mistake  AQAP 
made  was  backing  al-Dhahab  in  an  overt  manner  and  insisting 
that  al-Dhahab’s  fighters  proclaim  their  loyalty  to  AQAP.  This  led 
to  al-Dhahab’s  defeat  by  tribal  militias  backed  by  the  Yemeni  Army. 
The  Yemeni  government,  which  at  that  time  was  still  functioning, 
used  the  threat  of  airstrikes  and,  most  critically,  the  promise  of  in¬ 
creased  aid  to  get  local  tribes  to  fight  al-Dhahab  and  his  men.15 

It  was  not  until  2014,  when  AQAP  faced  a  sustained  offensive  by 
Houthi  and  allied  forces,  that  it  began  refining  its  approach  to  tribal 
engagement.16  AQAP  made  a  conscious  effort  to  mirror  the  Houthis’ 


more  successful  engagement  efforts.178  The  Houthis,  who  have  long 
relied  on  coalition-building  among  Yemen’s  northwest-based  tribes, 
do  not  insist  on— and  often  discourage — overt  alliances.  Their  ap¬ 
proach  is  pragmatic  and  strategic.18  They  offer  arbitration,  exper¬ 
tise,  weapons,  and,  most  importantly,  funds  to  those  tribal  leaders 
who  agree  to  fight  on  their  behalf.19 

Embracing  Gradualism 

AQAP’s  modified  approach  to  tribal  engagement  was  a  victory  for 
those  among  its  leaders  who  pushed  for  the  acceptance  of  a  more 
nuanced  strategy.  This  new  strategy,  which  included  promises  of 
cash  payments  in  exchange  for  support,  was  used  in  the  lead  up 
to  AQAP’s  April  2015  seizure  of  al-Mukalla,  Yemen’s  fifth  largest 
city.  AQAP’s  move  into  al-Mukalla  was  rapid  and  appeared  to 
come  with  little  warning.  The  swiftness  of  the  group’s  takeover 
of  al-Mukalla  and  much  of  the  southern  half  of  the  Hadramawt 
governorate  was  aided  by  months  of  preparation.20  The  prepara¬ 
tion  consisted  of  overtures  to  those  tribal  leaders  and  local  leaders 
that  AQAP  deemed  to  be  sympathetic  to  its  cause.  In  effect,  AQAP 
spent  months  building  coalitions  with  leaders  that  they  identified 
as  amenable  to  its  cause  and  bought  off  those  whom  were  not  with 
promises  of  money  and  weapons.21  These  efforts  laid  the  ground¬ 
work  for  the  rapid  and  largely  bloodless  April  takeover  of  the  city. 

The  speed  of  its  takeover  of  al-Mukalla  allowed  AQAP  to  seize 
weapons  and  materiel  from  nearby  Yemeni  Army  and  Central  Secu¬ 
rity  Force  bases.  Most  importantly,  AQAP  seized  an  estimated  $100 
million  from  the  al-Mukalla  branch  of  the  Yemeni  Central  Bank.22 
The  money,  far  more  than  the  weapons,  was  critical  to  AQAP’s  con¬ 
tinued  success;  it  allowed  it  to  expand  its  recruitment  efforts  and 
most  importantly,  to  fund  its  engagement  efforts  and  limited  public 
works  projects  in  al-Mukalla.23 

While  AQAP  focused  on  recruitment,  training,  and  engagement 
efforts  across  the  southern  half  of  Yemen,  it  left  the  day-to-day  gov¬ 
ernance  of  al-Mukalla  and  much  of  the  southern  half  of  Hadramawt 
to  local  leaders  with  whom  it  had  established  relationships.24  The 
decision  to  empower  local  leaders  and  allow  them  to  govern  as  prox¬ 
ies  is  reflective  of  AQAP’s  acceptance  of  a  more  covert  strategy.  This 
strategy  is  labeled  by  some  within  AQAP  as  the  al-yad,  al-makhji,  or 
invisible  hand  strategy.25  AQAP  also— with  some  exceptions— large¬ 
ly  resisted  the  temptation  to  impose  the  most  severe  aspects  of  its 


g  AQAP’s  renewed  focus  on  tribal  engagement  is  due  in  part  to  what  it  has 
learned  from  the  Houthis,  who  have  built  coalitions  that  cross  tribal  and 
sectarian  divisions.  Both  groups  emphasize  engaging  with  tribal  leadership 
as  a  means  to  penetrate  and  sustain  a  presence  within  communities. 

AQAP  is  mirroring  the  Houthis’  relatively  successful  attempts  to  gain 
allies  and  build  'coalitions’  of  supporters  in  strategic  parts  of  al-Shabwa, 
al-Bayda,  Marib,  and  Dhamar.  They  are  not  observing  from  afar.  Rather, 
in  many  areas,  AQAP  is  competing  directly  with  the  Houthis  for  the  same 
promises  of  support,  access,  and  information  from  tribes  and  clans.  In 
places  like  al-Bayda,  tribal  leaders  routinely  play  one  organization  off 
the  other  in  an  attempt  to  extract  better  terms.  AQAP  lost  a  great  deal 
of  support  in  al-Bayda  during  2014-15  due  to  its  heavy-handed  approach 
and  its  unwillingness  to  acknowledge  the  authority  of  established  elders. 

In  contrast  with  AQAP,  the  Houthi  leadership  went  directly  to  the  elders— 
those  that  were  left— and  asked  them  what  they  wanted  and  needed 
in  exchange  for  their  support.  Author  interviews,  various  Yemen-based 
experts  and  ex-government  officials,  September-November  2016. 
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Screen  capture  from  a  November  2016 AQAP  video 


interpretation  of  Islamic  law  in  al-Mukalla.h  In  al-Mukalla,  AQAP 
managed  to  build  a  measure  of  goodwill  due  to  this  relative  restraint 
and  its  provision  of  limited  public  works.26 

In  April  2016,  Saudi-  and  Emirati-backed  pro-government  forc¬ 
es  retook  al-Mukalla.  While  coalition  officials  claimed  that  this  was 
a  resounding  defeat  for  AQAP,  AQAP  called  its  withdrawal  from  the 
city  a  strategic  retreat  that  was  undertaken  to  ensure  civilian  lives 
were  not  lost. 27  The  coalition  effort  to  retake  the  city  resulted  in  few 
deaths  and  in  little  damage  to  the  city.  In  many  respects,  AQAP’s 
yearlong  occupation  of  a  city  of  300,000  validated  the  benefits  of 
gradualism  and  of  the  ‘hidden  hand’  approach  to  governance. 

The  ‘Hidden  Hand’  Strategy 

While  AQAP  has  moved  its  forces  from  al-Mukalla,  thanks  to  its 
gradualist  approach,  it  still  exercises  control  within  the  city  and  over 
the  surrounding  countryside.28  AQAP  anticipated  and  planned  its 
withdrawal  from  al-Mukalla.  Its  leadership  learned  firsthand  the 
perils  of  trying  to  face  down  conventional  forces  backed  by  air  assets 
in  2012.  AQAP  is  also  watching  the  war  against  the  Islamic  State  in 
Iraq  and  Syria  where  conventional  forces  have  inflicted  heavy  loss¬ 
es  on  the  Islamic  State.  AQAP’s  gradualists  clearly  favor  giving  up 
territory  rather  than  exposing  the  organization  to  heavy  losses  that 
would  also  cost  it  much  of  the  limited  goodwill  that  it  has  accrued 
over  the  last  two  years.  This  goodwill  is  viewed  as  critical  by  many 
within  AQAP.  This  view  has  been  further  buttressed  by  the  fact  that 
the  Islamic  State  in  Yemen’s  brutal  tactics  have  cost  it  much  of  the 
limited  support  that  it  once  enjoyed. 

This  control  is  exercised  through  the  network  of  informants  and 
sympathizers  that  AQAP  built  during  its  year  in  al-Mukalla.  This 
network  acts  as  its  eyes  and  ears  in  the  city  as  well  as  its  envoys  to 
some  members  of  the  globally  linked  Hadrawmi  business  commu¬ 
nity.  The  network  was  designed  to  function  as  a  stay-behind  force 
when  AQAP  withdrew.29 

Enhancing  intelligence  and  counterintelligence  capabilities  has 
long  been  a  priority  for  AQAP  both  as  a  means  to  ensure  the  sur- 


h  AQAP  did  publicly  execute  two  men  accused  of  spying  and  later  displayed 
their  bodies  on  planks.  Mohammad  Mukhashaf,  “Al-Qaeda  kills  two 
Saudi  accused  of  spying  for  America,"  Reuters,  June  17, 2015.  AQAP  is 
also  reported  to  have  overseen  the  stoning  of  a  married  woman  who  was 
accused  of  adultery.  “Al-Qaeda  stones  woman  to  death  for  adultery  in 
Yemen,"  Middle  East  Eye,  January  4, 2016.  See  also  Gregory  Johnsen,  “Al- 
Qa '  ida  and  the  Islamic  State  Benefit  as  Yemen  War  Drags  On,"  CTC  Sentinel 
9:1(2016). 


vival  of  the  organization  and  as  a  means  to  achieve  its  short-  and 
medium-term  goals.  However,  its  use  of  a  hidden  hand  approach 
to  governance  and  influence  operations  has  meant  that  it  has  pri¬ 
oritized  the  vetting,  funding,  and  training  of  more  intelligence  and 
counterintelligence  cells.30'  AQAP  clearly  recognizes  the  value— and 
dangers — of  human  intelligence  in  particular.  It  assigns  a  high  pri¬ 
ority  to  assassinating  members  ofYemen’s  intelligence  services  who 
pose  a  threat  to  the  group.31  AQAP’s  prioritization  of  the  formation 
of  more  intelligence  cells  aligns  with  its  leadership’s  embrace  of 
what  could  be  called  the  long  war.  It  is  employing  tactics  that  will 
prevent  it  from  being  easily  targeted  and  that  allow  it  to  continue 
to  act  through  proxies. 

Many  of  these  new  intelligence  cells  are  tasked  with  infiltrating 
tribal  militias  and  other  nominally  pro-government  forces  that  are 
fighting  the  Houthis.  The  members  of  these  AQAP  cells— some  of 
whom  have  been  recruited  from  the  Yemeni  intelligence  services— 
are  charged  with  identifying  ranking  individuals  who  may  be  sym¬ 
pathetic  to  AQAP’s  cause  and  then  offering  financial  and  military 
aid.1  While  these  efforts  are  ongoing  throughout  southern  Yemen, 
AQAP  is  focusing  on  the  strategic  frontline  areas  of  Taiz  and  Ibb  as 
well  as  northern  al-Bayda.32 

In  these  areas,  forces  opposing  the  Houthis— especially  in  Taiz— 
are  stretched  thin  and  often  suffer  from  shortages  of  money  and 
materiel.  As  one  commander  of  a  militia  based  in  Taiz  explained, 
“when  you  are  days,  if  not  hours  from  being  over-run,  you  do  not 
care  where  the  supplies  or  men  come  from  or  what  their  beliefs 
are  so  long  as  they  can  fight  and  are  fighting  the  same  enemy  you 
are.”  The  commander  added,  “we  can  sort  out  al-Qa  ida  after  we’ve 
beaten  the  Houthis.”33 

Enmeshment 

It  is  likely  that  many  of  the  leaders  of  rebel  groups  involved  in  the 
early  stages  of  the  uprising  against  Bashar  al  Assad’s  government 
in  Syria  thought  the  same  thing  as  the  commander  in  Taiz— that 
al-Qa  ida  can  be  dealt  with  after  defeating  Assad.  As  is  now  clear 
in  Syria,  al-Qa 'ida  and— to  a  lesser  degree— the  Islamic  State  have 


i  Much  like  Yemen’s  civil  war,  the  targeting  of  AQAP  by  drones  in  particular 
has  sped  up  AQAP’s  evolution.  The  drone  attacks,  some  of  which  have 
successfully  targeted  AQAP’s  leadership,  have  meant  that  AQAP  has  had 
to  develop  its  counterintelligence  capabilities  and  ability  to  ’go  dark’  in 
order  to  avoid  being  targeted.  The  drones  attacks  may  well  be  acting  as 
a  kind  of  artificial  form  of  'natural  selection’  whereby  those  operatives 
who  are  sloppy  and  break  protocols  are  killed,  leaving  behind  operatives 
who  are  more  careful  and  disciplined.  The  attacks  on  AQAP’s  top  and 
mid-tier  leadership  have  also  spurred  the  development  of  ‘apprenticeship’ 
programs  whereby  more  experienced  operatives  train  their  replacements. 
While  it  is  beyond  the  purview  of  this  article,  it  should  be  noted  that  there 
are  parallels  with  AQAP’s  heightened  attention  to  the  development  of 
intelligence  cells  and  al-Shabaab’s  development  of  its  amniyat  intelligence 
wing.  The  amniyat  has  proved  critical  to  al-Shabaab’s  ability  to  manage 
internal  security  and  to  co-opt,  most  often  through  violence,  leaders  among 
Somalia’s  clans  and  sub-clans.  Given  that  AQAP  maintains  a  relationship 
with  al-Shabaab,  it  is  likely  that  the  two  organizations  have  exchanged 
notes  on  the  best  ways  to  set  up  and  operate  intelligence  units. 

j  Yemen’s  two  primary  intelligence  services,  the  National  Security  Agency 
(NSA)  and  the  Political  Security  Bureau  (PSB),  have  a  checkered  past 
when  it  comes  to  making  use  of  militant  salafi  organizations  when 
this  is  deemed  useful  to  them  and  of  being  home  to  officers  who  are 
sympathetic  to  radical  ideologies.  Michael  Knight,  “Strengthening  Yemeni 
Counterterrorism  Forces:  Challenges  and  Political  Considerations," 
Washington  Institute,  January  6,  2010. 


JANUARY  2017 


CTC  SENTINEL 


21 


woven  themselves  into  the  very  fabric  of  these  groups  by  leveraging 
their  fighting  capabilities,  their  access  to  weaponry,  and  their  supe¬ 
rior  organizational  capabilities  in  exchange  for  support.34  In  effect, 
AQAP,  like  many  of  the  al-Qa '  ida  franchises,  is  undergoing  a  kind 
of  indigenization  whereby  they  identify  with— at  least  on  a  tactical 
level — the  aims  of  some  of  those  groups  fighting  the  Houthis.  There 
is  also  a  sectarian  element  to  the  war  in  Yemen,  although  this  is  far 
more  limited  than  in  Syria.  In  Yemen,  AQAP  readily  taps  into  these 
sectarian  tensions  and  exacerbates  them  where  possible.  In  fighting 
the  Houthis,  AQAP’s  messaging  emphasizes  the  idea  that  it  is  fight¬ 
ing  Shi '  a  apostates  that  are  acting  as  agents  of  Iran. 

The  sectarian  tensions  and  the  fragmentary  nature  of  those  forc¬ 
es  fighting  against  the  Houthis  are  providing  AQAP  with  ample  op¬ 
portunities  to  enmesh  itself  within  those  forces  fighting  against  the 
Houthis.35  k  Though  it  must  be  noted  that  AQAP  has  also  targeted 
some  pro-government  forces,  the  tempo  of  these  attacks  has  de¬ 
creased  markedly  over  the  last  year.* 1  Many  of  the  militias  and  recon¬ 
stituted  units  of  the  Yemeni  Army  that  are  loyal  to  the  government 
in  exile  are  poorly  trained  and  poorly  equipped.  In  addition,  many 
of  these  forces  are  also  unwilling  and  uninterested  in  fighting  the 
Houthis  and  their  allies.  This  is  due  to  both  the  Houthis’  reputation 
as  formidable  fighters  and  the  fact  that  most  of  the  men  who  make 
up  these  units  are  drawn  from  the  south.  As  southerners,  many  of 
them  are  more  interested  in  southern  independence  than  fighting 
against  the  northern-based  Houthis  and  for  a  unified  Yemen.36 

The  Saudi-led  coalition  has  struggled  to  motivate  newly  created 
and  reconstituted  pro-government  forces  to  consistently  support 
frontline  fighters  in  fiercely  contested  areas  like  Taiz.  The  failure  by 
Saudi-  and  Emirati-backed  forces  to  consistently  support  frontline 
fighters  has  allowed  AQAP  to  fill  the  void  by  providing  relatively 
well-trained  and  well-equipped  operatives.  AQAP  views  this  as  an 
opportunity  and  has  enmeshed  its  fighters  among  the  anti-Houthi 
militias  fighting  in  these  areas.  In  places  like  Taiz,  AQAP  maintains 
an  overt  and  covert  presence.  It  has  advisers  and  members  of  its 
intelligence  cells  who  do  not  openly  identify  as  AQAP  operatives 
serving  within  anti-Houthi  groups.  At  the  same  time,  AQAP  has 
assembled  groups  of  fighters  who  openly  fight  under  its  flag.  These 
detachments  frequently  act  as  strategic  reserves  for  anti-Houthi  mi¬ 
litias  fighting  in  Taiz  and  parts  of  Dhale  governorate.  A  commander 
of  a  pro-government  militia  in  Dhale  explained,  “they  [AQAP]  have 
prevented  many  defeats  [of  pro-government  forces  by  Houthi-al- 
lied  forces]  and  because  of  that  they  are  winning  support.  As  many 
of  my  own  men  know,  they  pay  better  and  their  men  never  seem  to 
run  out  of  ammunition  or  food.  Many  of  the  men  who  were  fight¬ 
ing  with  us  have  joined  them  not  because  of  what  they  teach  but 
because  of  how  they  fight  and  what  they  pay.”37 

In  what  seems  to  be  another  indication  of  the  acceptance  of  a 
more  gradualist  approach  to  achieving  its  goals,  AQAP  is  focused 
on  making  itself  indispensable  to  many  of  the  anti-Houthi  forces 


k  There  are  a  multiplicity  of  forces  fighting  against  the  Houthis  and  their 
allies.  These  include  reconstituted  units  of  the  Yemeni  Army,  tribal-based 
militias,  people's  defense  committees,  and  forces  aligned  with  various 
southern  separatist  organizations. 

I  AQAP  offered  harsh  criticism  of  the  December  10  Islamic  State  attack  on 
Yemeni  soldiers  at  an  army  base  in  Aden.  “Yemen's  Al-Qaeda  distances 
itself  from  'deviant'  IS,"  Middle  East  Online,  December  15,  2016. 


fighting  along  the  frontlines  of  Yemen’s  civil  war.  Its  ideological  and 
religious  goals  have  been  made  secondary— at  least  temporarily— to 
its  goal  of  securing  local  support.  This  has  been  reflected  by  the 
diminished  tempo  of  its  attacks  on  anti-Houthi  forces.  There  are 
few  reports  in  recent  months  of  attacks  on  anti-Houthi  forces  in 
frontline  areas. 

AQAP’s  enmeshment  within  anti-Houthi  forces  has  also  allowed 
AQAP  to  enhance  its  war  fighting  capabilities  in  multiple  areas.  The 
civil  war  has  acted  as  a  catalyst  for  AQAP’s  understanding  of  and 
ability  to  fuse  irregular  warfare  tactics  with  conventional  tactics 
reliant  on  heavy  weaponry.  Due  to  its  seizure  of  stockpiles  of  weap¬ 
ons  in  2015,  AQAP  now  has  access  to  a  range  of  heavy  weaponry.38 
It  initially  had  little  experience  with  using  such  weapons  systems, 
but  this  has  changed  over  the  last  year  as  AQAP  has  fought  set  piece 
battles  against  Houthi-allied  forces.  AQAP,  much  like  the  Houthis 
and  the  Islamic  State,  has  dramatically  increased  its  ability  to  en¬ 
gage  in  semi-conventional  warfare.39 

Looking  Forward 

Local  support  is  fundamental  to  AQAP’s  ability  to  sustain  itself  and 
to  its  expansion  in  Yemen.  However,  such  support  is,  to  a  great  ex¬ 
tent,  contingent  on  AQAP’s  willingness  to  restrain  itself  and  not 
alienate  those  it  seeks  to  govern.  The  leadership  of  AQAP  has  in¬ 
corporated  the  lessons  learned  during  its  defeats  and  setbacks  in 
2012-2014.  This  is  evidenced  by  AQAP’s  acceptance — at  least  for 
now— of  the  gradualist  approach  advocated  for  by  its  late  leader, 
al-Wuhayshi,  and  accepted  by,  at  least  to  some  degree,  its  current 
leader,  al-Raymi.  Fighting  the  long  war  necessitates  patience,  time, 
and  a  far  more  nuanced  approach  to  engaging  Yemen’s  tribes  and 
the  fragmented  forces  opposing  the  Houthis  and  their  allies. 

This  strategy  suggests  that  AQAP  is  currently  focused  on  orga¬ 
nizational  growth  in  Yemen.  While  AQAP’s  increasing  attention  to 
more  parochial  concerns  likely  means  that  it  is  less  concerned  with 
direct  attacks  against  foreign  targets,  its  adoption  of  what  is  a  far 
more  pragmatic  path  to  growth  should  be  of  great  concern  to  the 
region  and  the  United  States.”  AQAP’s  enmeshment  within  some 
anti-Houthi  forces  and  its  deepening  ties  with  some  tribal  com¬ 
munities  mean  that  it  is  even  more  resilient  and  harder  to  combat. 
This  combined  with  the  fact  that  the  civil  war  in  Yemen  will  likely 
continue— at  least  on  a  low  level— for  years  means  that  AQAP’s  fu¬ 
ture  is  more  secure  than  ever.  CTC 


m  While  AQAP  is  presently  devoting  most  of  its  resources  and  organizational 
energy  on  fighting  the  near-enemy  in  Yemen,  it  is  still  advocating  attacks  on 
the  far-enemy.  In  the  November  issue  of  its  English  language  publication, 
Inspire,  AQAP  continued  its  call  for  lone-wolf  attacks  on  Western  targets. 
The  lone-wolf  attacks  cost  AQAP  very  little  if  anything  in  terms  of  resources 
and  allows  them  to  maintain  continue  to  burnish  their  'jihadi'  credentials. 
The  attacks  also  are  less  likely  to  provoke  a  sustained  response  by 
Western  powers  that  could  cost  the  group  local  support.  AQAP  is  arguably 
on  a  clear  trajectory  to  becoming  a  far  more  parochial  organization. 

AQAP’s  recruitment  strategies  reflect  this.  It  is  more  of  a  purely  Yemeni 
organization  than  ever  before.  It  is  very  careful  not  to  use  Somalis  and 
other  foreign  recruits  in  sensitive  areas.  This  now  applies— though  far  less 
so— to  Saudis  as  well,  given  the  antipathy  to  Saudi  Arabia  in  many  parts  of 
the  country  (even  in  those  parts  under  the  nominal  control  of  KSA-backed 
forces). 
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Drone,  Counter  Drone:  Observations  on 
the  Contest  Between  the  United  States  and 
Jihadis 

By  Don  Rassler 


Armed  military-grade  drones  have  been  a  central  tool 
for  the  United  States  to  counter  the  threat  posed  by 
al-Qa'ida  and  the  Islamic  State.  It  is  therefore  not 
surprising  that  the  West’s  use  of  drones  has  been  a 
subject  of  intense  interest  for  these  groups  and  their 
supporters  online.  Indeed,  the  jihadi  community  for  years 
has  sought  ways  to  disrupt  and  limit  the  effectiveness  of 
armed  drones  and  to  deploy  its  own  drones  in  offensive 
ways.  As  the  United  States  and  other  countries  begin  to 
deploy  counter  drone  solutions  to  mitigate  the  jihadis’ 
offensive  drone  threat,  it  would  be  wise  to  game  out 
creative  and  inexpensive  ways  to  defeat  countermeasures 
being  deployed  by  the  West  so  the  jihadis’  response 
to  those  methods  can  be  anticipated  and  pre-empted. 


In  early  October  2016,  the  Islamic  State  used  an  explo¬ 
sive-laden  drone  to  kill  two  Kurdish  fighters  and  injure 
two  French  Special  Forces  soldiers.  The  group  was  able  to 
achieve  the  feat  not  by  some  sophisticated  technical  break¬ 
through,  but  rather  through  a  combination  of  deception 
(hiding  the  explosives  inside  the  device)  and  creativity  (detonating 
the  device  after  it  had  been  downed  by  Kurdish  forces  and  was  tak¬ 
en  back  to  their  base  for  inspection).1  This  event,  and  other  similar 
incidents  involving  terrorist  use  of  explosive-carrying  drones  over 
the  past  year,  has  led  to  a  push  by  the  United  States  and  other  na¬ 
tions  to  more  rapidly  field  a  plethora  of  drone  countermeasures.2 
These  solutions  range  from  drone-disabling  guns  and  small,  armed 
attack  drones  to  eagles  and  electronic  and  cyber  countermeasures.b 


a  Many  of  these  drone  countermeasure  systems  have  been  in  production 
for  years.  For  background,  see  Colin  Clark,  “New  Weapons  Spell  Death  for 
Drones:  the  Countermeasure  Dance,”  BreakingDefense.com,  October  13, 
2014. 

b  Since  the  early  2000s,  the  U.S.  Department  of  Defense’s  Black 
Dart  exercise  has  served  as  a  venue  to  test  out  these  various  types 
countermeasures.  For  background,  see  “Black  Dart:  The  U.S.  Military’s 
Countermeasure  against  Drones,”  NBC  Nightly  News,  August  8,  2016.  For 
background  on  the  use  of  eagles  to  take  down  commercial  drones,  see 
Kelsey  D.  Atherton,  “Trained  Police  Eagles  Attack  Drones  on  Command,” 
Popular  Science,  February  1,  2016. 
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As  these  various  approaches  are  pursued,  it  is  worth  consider¬ 
ing  how  groups  like  the  Islamic  State  are  going  to  respond  to  the 
deployment  of  these  systems  and  how  they  are  going  to  try  and 
defeat  them.2 

The  way  the  jihadi  community  has  sought  previously  to  counter 
the  West’s  use  of  armed  drones  provides  a  useful  window  in  this 
regard,  as  the  topic  has  been  a  thread  of  online  discussion  among 
jihadi  organizations  and  their  supporters  for  years.  This  article  pro¬ 
vides  a  general  overview  of  those  discussions  on  Arabic  language 
jihadi  forums,  drawing  on  postings  between  July  2005  and  Decem¬ 
ber  2013  collected  by  the  Combating  Terrorism  Center,  as  well  as 
other  open  source  material.3  This  article  specifically  outlines  the 
creative  and  resourceful  ways  that  jihadis  have  sought  to  counter 
armed  military  drones  since  9/11, c  and  it  does  so  with  the  aim  of 
providing  insight  into  how  the  jihadi  community  might  defeat  U.S. 
countermeasures  against  jihadi  drones. 

The  Jihadis’  Approach 

The  mujahidin  in  Som  alia  should  be  careful  of  the  air 


c  Due  to  their  popularity  when  data  was  collected  (2014),  attention  was 
specifically  placed  on  three  forums:  Shumukh  al-lslam,  Al-Fida,  and  Ansar 
al-Mujahidin.  The  CTC  gathered  and  cataloged  all  of  the  material  it  could 
find  on  these  three  forums  that  directly  referenced  or  commented  on 
drones,  unmanned  aerial  vehicles,  remote  control  planes,  or  other  similar 
search  terms  during  a  search  it  conducted  during  the  early  months  of  2014. 
This  search  process  yielded  218  drone-related  posts  that  were  included 
on  the  forums  between  July  2005  and  December  2013.  The  material  that 
was  recovered  as  part  of  this  process  fell  into  three  categories:  1)  official 
publications  or  statements  made  by  jihadi  groups:  2)  discussions  threads 
or  posts  submitted  by  senior  forum  writers  or  forum  administrators 
(i.e.  individuals  who  manage  and  run  the  forum  sites  and  serve  as  links 
between  jihadi  organizations  and  other  users  of  the  forums):  and  3)  posts 
and  comments  made  by  forum  members,  individuals  who  are  believed  to 
be  jihadi  sympathizers.  There  are  a  number  of  problems  and  limitations 
associated  with  this  approach,  and  in  using  the  second  and  third  categories 
of  forum-derived  information  specifically.  First,  while  the  forums  have 
served  as  an  aggregator  of  jihadi  content,  it  is  not  clear  how  representative 
the  material  posted  on  the  forums  is  of  the  broader  Sunni  jihadi  collective. 
Second,  since  a  direct  connection  usually  cannot  be  made  between 
jihadi  terrorist  groups  and  the  statements  made  by  forum  members  and 
administrators,  the  latter  category  of  information  functions  only  as  a  proxy 
for  the  views  of  jihadi  terrorist  entities  themselves.  This  is  not  to  say  that 
the  views  of  administrators  and  forum  members  are  not  useful,  but  rather 
that  researchers  should  be  cautious  about  making  strong  conclusions 
about  jihadi  groups  from  this  material  alone.  Third,  due  to  concerns  over 
surveillance  and  forums  being  targeted  by  government  agents  as  a  form  of 
collection,  forums  users  typically  mask  their  true  identities.  Thus,  it  is  not 
possible  to  establish  which  forum  users  are  genuine  jihadi  sympathizers 
and  to  differentiate  them  from  those  who  are  not.  Readers  should  read 
this  article  with  these  caveats  in  mind.  For  background  on  Arabic  language 
jihadi  forums,  see  Edna  Eraz,  Gabriel  Weimann,  and  Aaron  Weisburd,  "Jihad, 
Crime  and  the  Internet:  Content  Analysis  of  Jihadist  Forum  Discussions,” 
Report  Submitted  to  the  National  Institute  of  Justice,  October  31,  2011,  and 
Mohammed  al-Musawi,  “Cheering  for  Osama:  Flow  Jihadists  Use  Internet 
Discussion  Forums,”  Quillam  Foundation,  August  2010. 
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bombardments  and  should  benefit from  the  art  of  gathering 
and  dispersion  experience,  as  well  as  movement,  night  and 
day  transportation,  camouflage,  and  other  techniques  related 
to  war  tricks. 

—Letter  from  al-Qa '  ida  operative  Atiyyah  Abd  al-Rahman  to 
Mujahidin  in  Somalia  (al-Shabaab)4 

The  facts  prove  that  the  American  technology  and  ad¬ 
vanced  systems  cannot  capture  a  mujahid  if  he  does  not  make 
a  security  violation  that  will  lead  them  to  him.  Commitment 
to  operational  security  makes  his  technological  advancement 
a  waste. 

—Letter  from  Usama  bin  Ladin  to  Atiyyah5 

The  two  quotes  from  Atiyyah  and  bin  Ladin  above  speak  to  the 
important  role  countermeasures,  counterintelligence,  and  defen¬ 
sive  strategies  have  played  and  continue  to  play  in  the  survival  and 
endurance  of  groups  like  al-Qa 'ida  and  the  Islamic  State.  They 
reinforce  two  points.  First,  the  threat  to  these  groups  and  their  al¬ 
lies  across  the  globe  from  armed  drone  strikes  is  real.  And  second, 
good  operational  security  is  not  only  critical  to  their  survival  but 
is  also  required  to  counter  or  nullify  the  advantages  that  superior 
U.S.  technology  affords.  To  protect  themselves  and  limit  the  effects 
of  drones,  writers  active  on  jihadi  forums  have  released  tips  and 
operational  tradecraft  guides,  which  provide  recommendations  one 
should  follow  to  avoid  being  targeted  by  a  drone,  for  their  followers. 
To  draw  upon  the  collective  strength  and  knowledge  of  their  com¬ 
munity,  jihadi  forum  administrators  have  also  opened  the  discus¬ 
sion  to  the  masses,  as  an  attempt  to  crowdsource  countermeasures 
and  other  solutions— and  they  have  been  doing  so  since  at  least 
2011.6  Cash  prizes  have  even  been  offered.7 

The  approach  that  the  jihadi  community  has  taken  to  this  is¬ 
sue  is  fairly  thorough,  as  in  the  discussion  threads  online  one  can 
easily  see  jihadi  forum  members  conduct  vulnerability  assessments 
of  drones.  There  were  examples  of  different  individuals— or  small 
groups — trying  to  find  weaknesses  in  each  component,  from  sensors 
and  encryption  to  spies,  that  could  be  exploited  to  defeat  a  drone, 
limit  its  accuracy,  or  enhance  survivability. 

Such  investment  in  countermeasures,  is  certainly  not  new  as  ter¬ 
rorist  groups  of  all  persuasions  have  long  sought  ways  to  reduce  the 
effectiveness  of  their  adversaries’  actions  and  to  learn  from  others.8 
As  noted  by  Brian  Jackson  and  his  colleagues  at  RAND,9  counter¬ 
measures,  even  when  successful,  usually  only  have  a  limited  shelf 
life,  necessitating  consistent  focus  for  any  terror  group.10 

To  make  sense  of  terror  counter-technology  dynamics,  Brian 
Jackson  and  his  colleagues  at  RAND  developed  a  typology  with 
four  meta-categories.  This  typology  is  useful  in  that  it  helps  to  situ¬ 
ate  analytically  the  countermeasures  deployed  by  terrorist  groups. 
The  four  meta-categories  created  by  RAND  include:  altering  oper¬ 
ational  practices,  making  technological  changes  or  substitutions, 
avoiding  the  technology,  and  attacking  the  technology.11  While  a 
terrorist  group’s  effort  to  counter  drones  can  usually  be  placed  into 
one  of  these  categories,  they  are  not  mutually  exclusive.  As  revealed 
below,  sometimes  a  terror  group’s  approach  is  more  complex  and 


Screen  capture  from  a  video  released  by  Jund  al-Aqsa  in  September 
2016  showing  a  munition  being  dropped  from  a  commercial  drone 
in  Syria 


fits  into  several  of  them.d 

The  solutions  proposed  by  the  jihadi  community  in  its  online 
marketplace  for  ideas  are  best  thought  of  as  a  spectrum  that  ranges 
from  the  silly  to  the  somewhat  sophisticated.  A  jihadi  who  went  by 
the  name  Abu  'Ubayda  'Abdullah  al-'Adam  served  as  a  pioneer 
in  this  space  and  added  some  institutional  structure  and  formality 
to  the  jihadis’  discussions  on  the  topic.  Before  his  reported  death 
in  a  drone  strike  in  Pakistan  during  the  spring  of  2013,  U.S.  intelli¬ 
gence  agencies  believed  al- '  Adam  served  as  al-Qa '  ida’s  intelligence 
chief.12  He  also  authored  and  released  a  series  of  “reports”— all  iden¬ 
tified  by  the  Terrorism  Industry  title  that  they  carried — that  pro¬ 
vided  decentralized  advice  on  operational  tradecraft  and  security 
to  anyone  perusing  the  jihadi  forums.  Several  of  al-  'Adam’s  reports 
focused  on  drone  strikes  so  that  the  specific  practices  that  contrib¬ 
uted  to  the  strikes  could  be  diagnosed  and  corrected.  What  follows 
is  a  summary,  organized  along  the  lines  of  the  RAND  typology  de¬ 
scribed  above,  of  the  countermeasures  that  al-'Adam  and  other 
jihadi  sympathizers  have  discussed,  recommended,  or  practiced. 

Altering  Operational  Practices/Avoiding  the 
Technology 

Physical  Responses  and  Efforts  to  Conceal 

One  major  area  of  discussion  byjihadi  forum  members  online  were 
efforts  to  harden  and  camouflage  facilities.  As  explained  by  al-  'Ad¬ 
am,  “the  camouflage  is  used  to  mislead  [the  enemy],  and  prevent 
[one  from]  becoming  a  clear  target.  For  example:  The  place  that 
we  use  to  build  VIEDs  [Vehicle-Borne  Improvised  Explosive  De¬ 
vices]  should  be  covered.  It  is  a  big  mistake  to  use  an  open  space  to 
build  VIEDs  even  if  we  are  doing  that  here,  in  Afghanistan,  or  in  a 
secure  area  [that]  cannot  be  reached  by  the  enemy.”13  He  made  the 
consequences  of  not  concealing  your  position  clear:  “If  you  do  your 
work  in  an  open  area,  you’ll  become  an  easy  and  open  target  for 
the  unmanned  aerial  vehicles  and  the  spying  planes.”14  In  addition 
to  working  inside  and  covering  sensitive  locations,  other  jihadis  re¬ 


el  As  noted  by  RAND  in  its  report,  "reflecting  this  complexity,  the  four 
strategies  are  likely  better  viewed  as  the  extremes  of  four  overlapping 
sets  ...  in  which  specific  counterefforts  may  draw  on  one  or  more  of 
the  basic  strategies  in  an  effort  to  defeat  or  circumvent  a  specific 
defensive  technology."  Brian  A.  Jackson  et  al.,  Breaching  the  Fortress  Wall: 
Understanding  Terrorist  Efforts  to  Overcome  Defensive  Technologies  (Santa 
Monica,  CA:  RAND  Corporation,  2007),  p.  118. 
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sponded  to  this  thread  online  with  more  trivial  ideas,  such  as  hiding 
under  dense  trees,  burning  tires  (so  that  a  smokescreen  would  be 
created),  and  digging  tunnels.15 

The  most  sophisticated  concealment  measure  investigated  by 
jihadi  forum  users  online  was  a  line  of  counter-surveillance  clothing 
created  by  New  York  City  designer  Adam  Harvey  in  2013.16  The 
product  that  Harvey  developed,  in  which  the  jihadis  took  particu¬ 
lar  interest  in  and  reposted,  were  garments  made  out  of  material 
that  masks  and  suppresses  body  heat— material  that,  as  a  video 
released  on  Harveys  website  illustrates,  limits  the  effectiveness  of 
forward-looking  infrared  imaging  (FLIR)  systems,  a  key  sensor 
drones  use  for  targeting.17  In  addition  to  having  an  awareness  of 
Harvey’s  work,  jihadi  members  online  also  discussed  how  to  create 
homemade  remedies,  with  one  user  suggesting  that  sand  should 
be  sewn  between  two  pieces  of  clothing  to  achieve  a  similar  effect.18 

Hardening  facilities  was  an  additional  area  of  focus  with  anoth¬ 
er  prominent  writer,  Abu  '  Abd  al-Rahman  al-Qahtani,  suggesting 
people  should  move  their  offices  to  the  basement  of  a  house,  work 
out  of  caves,  or  place  sand  bags  on  their  roofs  to  limit  attrition  and 
dampen  the  blast  effects  of  strikes.19 

Altering  Personal  Tactics,  Techniques,  and  Procedures  (TTPs)  to 
Reduce  Targeting  and  Evade  Drones 

Discussions  regarding  changes  to  personal  TTPs  were  predicated 
on  a  general  understanding  of  the  sensors  with  which  most  mili¬ 
tary  grade  drones  are  equipped.  This  included  jihadi  contributors 
having  an  awareness  of  high-resolution  cameras  and  thermal  im¬ 
aging  technology  that  drones  can  have  on  board  and  the  ability  of 
these  platforms  to  work  as  “efficiently  at  night  as  they  do  in  the 
day  time.”20  There  was  also  an  awareness  that  drones  study  their 
targets’  movement  and  pattern  of  life.  As  al-'Adam  explained  in 
Episode  12  of  his  Terrorism  Industry  series,  “the  unmanned  aerial 
vehicle  (UAV),  especially,  is  able  to  determine  your  location  and 
watch  your  movements  and  there  does  not  need  to  be  a  mobile 
phone  [in  your  possession].  The  UAV  has  the  ability  to  precisely 
pinpoint  your  position  via  your  movements.”21  To  address  these  is¬ 
sues,  al-Qahtani  suggested  common  operational  security  practices 
such  as  frequently  changing  travel  routines  and  bed-down  locations 
(to  include  shifting  to  those  far  away  from  areas  with  known  drone 
activity).22  Abdullah  al-  'Adam,  citing  the  reasons  and  mistakes  that 
led  to  the  assassination  of  Abu  Hamza  al-Rabia — an  Egyptian  who 
served  as  al-Qa'ida’s  international  operations  planner  before  his 
death  by  drone  strike  in  2005— recommended  that  changes  also 
be  made  to  the  circle  around  oneself  after  a  failed  assassination 
attempt.23  Al-'Adam  believed  that  al-Rabia’s  demise  was  a  result 
of  him  not  making  these  changes  after  a  prior  attempt  on  his  life.24 

Not  surprisingly,  the  use  of  electronic  devices  to  evade  drone  sur¬ 
veillance  and  associated  strikes  was  a  rich  thread  of  discussion.6  It 
was  on  this  topic,  perhaps  more  than  any  other,  that  the  jihadi  com¬ 
munity’s  concerns  over  operational  security  were  most  evident.25 
It  was  also  the  area  where  the  countermeasures  and  operational 
tradecraft  guidance  was  the  most  specific. 


e  Another  interesting  thread  of  discussion  contained  conversations  about 
the  tactical  and  operational  behavior  of  drones  in  the  area  and  the  apparent 
trends  or  signs  that  the  jihadis  have  noticed  about  their  altitude  and  other 
performance  immediately  before  a  strike.  For  background,  see  '  Abir  Sabil5, 
"A  Temporary  Solution  to  the  UAV:  Participate  with  what  you  Know,"  Ansar 
al-Mujahidin  forum,  October  2012. 


Attacking  the  Technology 

As  one  might  expect,  a  considerable  amount  of  attention  was  paid 
to  devising  ways  to  attack,  disrupt,  or  sabotage  drones  and  the  lo¬ 
gistics  chain  associated  with  them. 

Jamming 

One  particular  area  of  interest  for  the  jihadis  was  disrupting  the  sig¬ 
nals  that  guide  and  control  drones,  a  practice  commonly  known  as 
‘jamming.’  For  this  to  be  accomplished,  the  actor  seeking  to  disrupt 
a  system  needs  to  deploy  radio  or  other  electronic  measures  to  in¬ 
terfere  with  a  specific  drone’s  system,  which — if  executed  properly — 
would  limit  that  device’s  ability  to  operate  effectively.  The  jamming 
solutions  proposed  by  jihadi  sympathizers  online  were  mostly  do-it- 
yourself  in  character  and  consisted  of,  for  example,  using  “a  regular 
water  pump  generator...  after  attaching  to  it  a  30-meter  copper 
pipe,”  “old  pieces  of  [unspecified]  communications  equipment, 
because  their  frequencies  are  very  strong,”  or  the  “Russian-made 
Rascal  device.”26  The  latter  is  software  that  broadcasts  “frequencies 
or  a  band  of  frequencies  to  cut  off  the  communications  or  to  jam 
the  frequencies  that  are  used  to  control  the  drone.”27  More  recently, 
in  a  forum  post  from  November  2015,  a  participant  encouraged  Is¬ 
lamic  State  fighters  to  use  a  GPS  signal  and  radio  frequency  jammer 
called  Wave  Bubble.28 

Intercepting  Feeds,  GPS  Spoofing,  and  Hacking 
Another  related  area  of  vulnerability  that  jihadi  forum  users  fo¬ 
cused  on  were  the  data  links/feeds  that  allow  drones  to  commu¬ 
nicate  and  share  data  with  their  controllers.  Particular  emphasis 
in  these  discussions  was  placed  on  intercepting  drone  feeds.  In 
late  2009,  media  reports  surfaced  detailing  the  ability  of  Kataib 
Hezbollah,  a  Shi '  a  militant  group  active  in  Iraq,  to  intercept  data 
from  U.S.  drones.29  According  to  these  accounts,  the  Shi '  a  militants 
intercepted  the  “feeds  by  taking  advantage  of  an  unprotected  com¬ 
munications  link  in  some  of  the  remotely  flown  planes’  systems.”30 
They  did  so  by  using  a  Russian  software  program  called  SkyGrabber 
that  was  “intended  to  steal  satellite  television”  and  was  available  for 
purchase  for  $26  on  the  internet.31  By  creatively  repurposing  this 
software,  Kataib  Hezbollah  was  able  to  “download  real-time  video 
feeds  from  American  surveillance  drones  as  they  flew  over  Iraq  ... 
[which  allowed  them  to]  both  monitor  and  evade  U.S.  operations.”32 
The  U.S.  military  learned  of  the  problem  after  “they  apprehended 
a  Shiite  militant  whose  laptop  contained  files  of  intercepted  drone 
video  feeds.”33  Jihadi  forum  contributors  were  aware  of  this  soft¬ 
ware,  as  their  posts  directly  referenced  both  the  software  and  press 
coverage  about  its  use  by  insurgents  in  Iraq.34 

Jihadi  forum  users  also  had  awareness  of  successful  ‘spoofing’ 
of  a  small,  commercially  purchased  drone  by  a  team  at  the  Uni¬ 
versity  of  Texas  at  Austin’s  Radionavigation  Laboratory,  which 
was  featured  in  U.S.  media  in  June  2012.  The  researchers  were 
able  to  take  control  of  the  drone’s  GPS  navigation  system  so  they 
could  fly  and  direct  the  device  themselves.35  It  should  be  noted  that 
military-grade  drones,  like  the  Reaper  and  Predator,  are  more  so¬ 
phisticated,  and  their  feeds  have  higher  levels  of  encryption  than 
commercially  available  drone  variants,  making  it  more  difficult  for 
an  external  party  to  spoof  or  otherwise  send  those  more  advanced 
versions  false  instructions.  Yet,  a  number  of  incidents  reveal  that 
the  encryption  of  military-grade  drone  feeds  is  a  cat-and-mouse 
game  being  played  out  between  the  United  States  and  its  adversar¬ 
ies,  as  America’s  enemies  are  looking  for— and  in  some  cases  have 
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previously  found — ways  to  gain  access  to  military  drone  data  feeds. 

A  number  of  cases  that  have  been  publicized  involve  Iran  and  its 
proxies,  which  is  not  necessarily  surprising  as  Hezbollah  successful¬ 
ly  tapped  into  Israeli  drone  feeds  in  1996,  an  advantage  that  led  to 
the  1997  massacre  of  11  Israeli  commandos  during  a  cross-border 
operation  in  Lebanon.36  (Hezbollah’s  ability  to  gain  access  to  Israel’s 
drone  feeds  at  the  time  allowed  it  to  gain  insights  into  the  facilities 
the  Israelis  were  monitoring.  This  meant  that  instead  of  the  Israeli 
targeting  operation  surprising  Hezbollah  fighters,  they  were  there 
waiting  for  it.)  In  2011,  Iran  claimed  that  it  was  able  to  take  over 
the  GPS  system  of  the  United  States’  advanced,  stealth  RQ-Senti- 
nel  drone  while  it  was  conducting  a  reconnaissance  mission  near 
Iranian  territory.37  The  United  States  has  disputed  the  charge  and 
claims  that  Iran  recovered  the  drone  after  it  crash-landed  within 
its  borders.38 

Another  form  of  drone  takeover  can  be  achieved  via  hacking.  For 
example,  in  2013,  an  enterprising  programmer  based  in  the  United 
States  developed  software  called  Skyjack  that  allows  the  user  to  seek 
“the  wireless  signal  of  any  other  [commercial]  drone  in  the  area.”39 
The  program  then  “forcefully  disconnects  the  wireless  connection 
of  the  true  owner  of  the  target  drone,  then  authenticates  with  the 
target  drone  pretending  to  be  its  owner,”  which  allows  the  user  to 
take  control  of  the  drone.10  All  that  was  required  to  facilitate  this 
takeover  was  “a  Parrot  AR.Drone  2,  a  Raspberry  Pi,  a  USB  battery, 
an  Alfa  AWUS036H  wireless  transmitter,  aircrack-ng,  node-ar- 
drone,  node.js,  and  ...  Skyjack  software.”11  Another  researcher  has 
developed  a  way  to  hack  into  DSMx,  “a  widely  used  remote  control 
protocol  for  operating  hobbyist  drones,  planes,  helicopters,  cars, 
and  boats,”  allowing  the  hijacker  to  control  other  nearby  drones.12 
Given  the  jihadis’  interest  in  counter-drone  technologies,  it  has  to 
be  assumed  that  both  these  tools  have  caught  their  attention. 

Homing  Beacons,  Spies,  and  Counterintelligence 
Discussions  on  the  jihadi  forums  also  centered  on  attempts  to  at¬ 
tack  and  defeat  the  methods  that  the  jihadis  believe  link  a  drone 
missile  to  its  target.  The  majority  of  their  attention  focused  on 
learning  about  homing  beacons  that  transmit  electromagnetic  or 
infrared  signals  and  local  spies  who  they  believe  place  the  beacons 
or  use  other  means  to  identify  which  facility  or  individual  should 
be  targeted.13  Official  jihadi  publications  have  even  included  pic¬ 
tures  of  specific  beacons  that  were  allegedly  recovered  from  spies 
in  Pakistan’s  tribal  areas.11  To  defeat  these  beacons,  al-Qahtani  send 
out  a  request  across  the  forums  for  additional  information  on  these 
devices  and  how  they  work.  He  specifically  wanted  to  know  “the  fre¬ 
quency  these  waves  work  on”  and  recommended  that  people  send 
in  strategies  for  how  they  could  be  defeated.15 

Jihadi  terror  groups  have  also  set  up,  or  bolstered,  counterintel¬ 
ligence  units  to  root  out  spies/  These  efforts  have  been  accompa- 


f  Hamas  has  set  up  similar  units  to  hunt  down  Israeli  collaborators.  See 
Jackson  et  at,  Breaching  the  Fortress  Wall,  p.  25;  for  a  comprehensive 
overview  of  terrorism  and  counterintelligence,  see  Blake  W.  Mobley, 
Terrorism  and  Counterintelligence:  How  Terrorists  Avoid  Detection  (New 
York:  Columbia  University  Press,  2012). 
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nied  by  efforts  to  share  knowledge  regarding  how  spies  operate  as 
well  as  practical  steps  that  group  members  can  take  to  help  identi¬ 
fy  them  or  limit  their  effectiveness.  The  information  being  shared 
ranges  from  the  obvious— “anyone  who  uses  communication  de¬ 
vises  should  be  secretly  tracked”— to  the  more  specific,  including 
information  aimed  at  creating  awareness  about  methods  used  by 
local  and  state  intelligence  units  to  recruit  spies.16  For  example, 
a  significant  portion  of  issue  19  of  the  Terrorism  Industry  series 
provides  a  detailed  overview  of  the  method  used  by  the  Pakistani 
Army  to  coerce  a  local  shopkeeper  in  Waziristan  to  target  a  want¬ 
ed  individual.  According  to  the  report,  the  Pakistani  Army  got  the 
shopkeeper  to  act  on  its  behalf  through  an  incremental  approach 
that  started  with  an  exchange  of  small  favors  involving  money.17 
This  created  an  environment  where  the  shopkeeper  became— even 
if  on  a  small  scale — indebted  to  his  recruiter  and  took  actions  that 
he  might  not  have  otherwise,  such  as  placing  a  tracking  device  in  a 
militant’s  car.18  The  sharing  of  these  types  of  anecdotal  stories  with 
online  jihadi  sympathizers  is  designed  to  both  educate  those  on  the 
forums  and  to  serve  as  a  cautionary  tale  to  deter  future  spies  and 
potential  collaborators,  as  the  story  told  in  issue  19  ends  with  the 
local  spy  being  discovered  and  killed.19 

Conclusion 

Although  many  of  the  countermeasures  outlined  above  are  ama¬ 
teurish  and  driven  by  common  sense,  they  also  speak  to  a  certain 
level  of  focus  and  commitment  by  the  jihadi  community  to  achieve 
two  goals:  1)  to  understand  their  adversaries  (and  their  strengths) 
and  2)  to  be  resourceful  and  work  with  what  they  have.  A  central 
lesson  for  the  United  States  and  its  allies,  given  the  cost  and  time 
associated  with  the  development  of  drone  countermeasures,  is  that 
efforts  should  be  made— and  made  early — to  defeat  the  counter¬ 
measures  being  deployed  by  the  West  so  the  jihadis’  response  to 
those  methods  can  be  anticipated  and  pre-empted. 

Two  ways  to  achieve  this,  if  not  already  being  done,  would  be  for 
the  United  States  to  integrate  such  efforts  into  its  annual  Black  Dart 
drone  exercise  and  to  sponsor  a  competition— accessible  by  a  wide 
range  of  participants— that  rewards  the  discovery  of  low-cost  and 
practical  ways  to  overcome  Western  drone  defeat  devices.  Such  an 
approach  would  take  a  page  out  of  the  jihadi  playbook  and  could 
produce  interesting  revelations  about  the  tools  the  United  States 
plans  to  deploy  in  the  field,  and  it  could  also  highlight  other  drone 
defense  gaps  that  have  yet  to  be  considered.  To  protect  any  vulner¬ 
abilities,  it  would  be  important  not  to  publicize  the  findings  from 
these  efforts,  as  the  jihadi  community  is  paying  attention  to  media 
coverage  of  these  types  of  topics. 

Another  major  takeaway  is  that  detailed  drone  countermeasure 
conversations  by  jihadis  online  should  be  mined  for  useful  solutions 
that  can  be  exploited  by  U.S.  forces  and  their  partners  in  the  field. 
The  jihadis  identification  of  software  like  SkyGrabber  and  other 
similar  programs  that  are  more  current  could  prove  useful  to  under¬ 
standing  the  myriad  mix  of  countermeasures  that  maybe  deployed 
to  circumvent  or  fool  drone  defeat  systems. 
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Sub-Saharan  Africa’s  Three  “New”  Islamic 
State  Affiliates 

By  Jason  Warner 


Although  global  attention  toward  the  Islamic  State 
has  generally  focused  on  the  Middle  East,  the  group  is 
finding  adherents  throughout  sub-Saharan  Africa  as 
well.  Three  “new”  Islamic  State  affiliates  have  come  to 
the  fore:  the  Islamic  State  in  the  Greater  Sahara,  the 
Islamic  State  in  Somalia,  and  the  Islamic  State  in  Somalia, 
Kenya,  Tanzania,  and  Uganda.  What  commonalities  do 
these  three  new  Islamic  State  franchises  in  Africa  have 
with  one  another?  Where  do  they  converge  or  diverge 
ideologically,  operationally,  and  strategically,  and  more 
importantly,  what  might  their  presence  mean  in  the  future? 


While  recent  news  on  the  Islamic  State  centers 
on  the  siege  of  Mosul  in  Iraq,  the  group’s  ideo¬ 
logical  hold  in  sub-Saharan  Africa  has  been 
quietly  growing,  and  not  simply  in  relation 
to  its  well-known  merger  with  Boko  Haram. 
Indeed,  over  the  past  year-plus,  three  new  Islamic  State  affiliates11 
have  gained  prominence  in  sub-Saharan  Africa.  In  West  Africa,  the 
group  known  as  the  Islamic  State  in  the  Greater  Sahara  (ISGS)  has 
gained  prominence  with  a  string  of  deadly  attacks  in  September 
and  October  2016.  Simultaneously,  across  the  continent,  in  the 
semi-autonomous  northern  Somali  stretch  of  Puntland,  a  group 
known  as  the  Islamic  State  in  Somalia  (ISS)  was  recently  the  first 
Islamic  State  affiliate  to  hold  territory  in  that  county,  while  further 
south,  another  Islamic  State  affiliate  known  as  the  Islamic  State 
in  Somalia,  Kenya,  Tanzania,  and  Uganda  (ISISSKTU)  has  raised 


a  It  should  be  noted  that  although  this  article  refers  to  these  groups  as 
“Islamic  State  affiliates,”  this  terminology  is  used  in  a  colloquial  (not 
technical)  sense.  Indeed,  only  one  group,  the  Islamic  State  in  Greater 
Sahara,  has  actually  received  acknowledgment  from  Islamic  State  leaders, 
thus  meeting  the  reciprocal  requirements  of  a  true  “affiliate.”  While  the 
other  two  have  pledged  bay' a,  the  fact  that  Islamic  State  leaders  have 
not  accepted  them  suggests  more  tenuous  links  between  the  two  groups. 
Nevertheless,  after  much  consideration,  the  author  believes  that  "affiliate" 
more  accurately  captures  the  relationships  between  the  groups  than 
alternatives  such  as  “ally,"  “sympathizer,”  or  “adherent." 


Dr.  Jason  Warner  is  an  assistant  professor  in  the  Department  of 
Social  Sciences  at  the  U.S.  Military  Academy  at  West  Point  and  an 
associate  at  the  Combating  Terrorism  Center.  He  holds  a  Ph.D.  in 
African  Studies  from  Harvard  University.  Follow  @warnjason 


concerns.11 

Besides  their  emergence  at  broadly  similar  times,  this  article  ex¬ 
amines  the  commonalities  these  three  new  Islamic  State  franchises 
in  Africa  have  with  one  another  as  well  as  their  convergences  and 
divergences  at  the  ideological,  operational,  and  strategic  levels.  It 
also  assesses  what  their  presence  could  mean  in  the  long-term. 

Islamic  State  in  Greater  Sahara 

The  story  of  ISGS  begins  with  the  merging  of  two  other  jihadi 
groups:  the  Movement  for  Oneness  and  Jihad  in  West  Africa  (MU- 
JAO)  and  the  Masked  Men  Brigade,  which  created  a  third  group, 
al-Mourabitoun,  in  August  2013.  Under  the  leadership  of  Mokhtar 
Belmokhtar— the  infamous,  one-eyed  commander  of  al-Qa'ida  in 
the  Islamic  Maghreb  (AQIM)— al-Mourabitoun  operated  without 
any  official  affiliation  for  the  first  two  years  after  its  founding.1 

However,  in  May  2015— and  evidently  taken  with  the  pro-Is- 
lamic  State  tide  during  its  brighter  times  of  mid-2015  (the  month 
the  Islamic  State  took  over  both  Ramadi  in  Iraq  and  Palmyra  in 
Syria) — Adnan  Abu  Walid  Sahraoui,  then  a  senior  leader  within 
al-Mourabitoun,  issued  a  pledge  of  bay  'a  to  the  Islamic  State. 
For  his  part,  Belmokhtar  rejected  that  pledge,  emphasizing  that 
Sahraoui’s  bay  'a  was  made  as  an  individual  pledge,  and  not  on 
behalf  of  al-Mourabitoun  as  a  group.  An  internecine  battle  within 
al-Mourabitoun  ensued  between  Belmokhtar’s  pro-AQIM  faction0 
and  Sahraoui’s  pro-Islamic  State  faction.  Reports  suggest  that  the 
battle  may  have  actually  been  physical.2  Shortly  thereafter,  Sahraoui 
and  other  pro-Islamic  State  members  of  al-Mourabitoun  defected, 
forming  the  Islamic  State  in  Mali,  which  has  now  become  the  Is¬ 
lamic  State  in  the  Greater  Sahara.3  Despite  Sahraoui’s  defection, 
his  group’s  May  2015  pledge  to  the  Islamic  State  went  unanswered. 
ISGS  seemingly  fell  dormant. 

However,  in  late  2016,  the  group  showed  itself  to  be  far  from 
defunct.  In  the  last  quarter  of  2016,  it  carried  out  three  notable 


b  Despite  the  fact  that  this  article  refers  to  these  groups  as  the  “Islamic 
State  in  X,"  these  nomenclatures  are  derivatives  of  Western  media  and 
analytical  practices  and  not  always  reflective  of  the  names  by  which  the 
groups  refer  to  themselves.  Instead,  when  referring  to  themselves,  the 
ISGS  has  previously  called  itself  both  “the  Greater  Sahara  Division"  and 
“al-Mourabitoun”  (though  a  distinct  branch  from  the  Belmokhtar-led, 
al-Qa '  ida-affiliated  al-Mourabitoun  that  is  contemporarily  better  known  by 
that  name);  Boko  Haram  under  Shekau  has  historically  referred  to  itself  as 
“Jama’atu  Ahlis  Sunna  Lidda’awati  wal-Jihad,"  “Wilayat  Gharb  Afriqiya,”  and 
“Wilayat  West  Africa;”  ISS  has  referred  to  itself  as  “Abnaa  ul-Calipha;”  and 
the  ISISSKTU  self-references  as  “Jahba  East  Africa.” 

c  After  Sahraoui’s  defection,  the  shura  council  of  al-Mourabitoun  declared 
Belmokhtar  the  new  leader  of  the  group  in  August  2015.  Under  his 
leadership,  al-Mourabitoun  has  been  firmly  allied  with  al-Qa'  ida. 
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Screen  capture  from  October  2016  video  ofMurabitoun’s  bay '  a  to  the  Islamic  State 


attacks6  near  the  borders  of  Burkina  Faso,  Niger,  and  Mali.  The  first 
attack  occurred  on  the  nights  of  September  1-2,  2016,  when  ISGS 
targeted  a  gendarmerie  in  Burkina  Faso  near  the  Nigerien  border 
and  killed  two  guards.  The  second  occurred  about  a  month  later  on 
October  12.  The  group  attacked  a  police  outpost  in  Intoum,  Burki¬ 
na  Faso,  just  kilometers  from  the  Mali  border,  which  killed  three 
police.  The  third,  and  certainly  most  sophisticated,  was  ISGS’  or¬ 
chestration  of  an  attempted  jailbreak  of  the  high-security  Koutou- 
kale  Prison  in  Niamey,  Niger,  on  October  17,  2016.  Though  guards 
ultimately  fully  repelled  the  attack— killing  one  assailant  wearing 
a  suicide  vest— the  attempted  prison  break  was  important  in  that 
the  prison  held  suspected  Boko  Haram  affiliates  and  other  suspect¬ 
ed  Islamist  militants  from  the  Sahara  and  Sahel.  Apart  from  these 
larger-scale  attacks,  ISGS  has  undertaken  other  criminal  activities.6 

It  is  perhaps  no  coincidence  that  just  weeks  after  the  third  ma¬ 
jor  attack,  the  Islamic  State  finally  acknowledged  the  bay  'a  that 
ISGS  had  pledged  nearly  17  months  earlier  in  May  2015.  Although 
the  Islamic  State  is  no  longer  in  the  habit  of  officially  “accepting” 
bay at, f  by  virtue  of  the  fact  that  it  posted  the  video  of  Sahraoui’s 
pledge  (which  refers  to  his  brigade  as  “al-Mourabitoun,”  though 


d  Despite  these  notable  attacks,  others  have  argued  that  ISGS  has,  in  fact, 
carried  out  many  other  attacks  without  claiming  responsibility.  "West  Africa 
Analysis:  Islamic  State  recognizes  ISGS  as  West  African  affiliate  following 
increased  attacks  in  recent  months,  despite  17  month  silence,"  Max 
Security,  November  17, 2016. 

e  The  group  is  believed  to  have  kidnapped  and  to  still  be  holding  a  Romanian 
national,  abducted  by  Sahraoui’s  contingent  in  Tambao,  Burkina  Faso 
in  2015,  just  before  it  officially  split  from  Belmokhtar’s  contingent  of  al- 
Mourabitoun.  Moreover,  ISGS  seems  to  understand  its  area  of  operation 
to  be  quite  wide,  having  issued  threats,  for  example,  against  the  United 
Nations  in  Western  Sahara  as  well  as  civilians  and  other  targets  of  the 
Moroccan  state.  Caleb  Weiss,  “Islamic  State’s  Sahara  branch  claims  first 
attack  in  Burkina  Faso,”  Long  War  Journal,  September  4,  2016. 

f  While  the  Islamic  State  has  not  released  any  statements  declaring  that 
it  no  longer  officially  accepts  bay' a,  the  last  one  that  it  accepted  was  by 
the  group  now  recognized  as  Wilayat  al-Kavkaz  on  June  23,  2015,  despite 
pledges  from  other  potent  Islamic  State  sympathizers. 


the  pro-al-Qa'ida  Belmokhtar  faction  of  that  group  still  exists)  on 
its  Telegram  channel  on  October  30,  2016,  it  has  de  facto  accepted 
the  pledge.4  Yet,  despite  the  Islamic  States  acknowledgement  of  its 
pledge,  ISGS  has  not  been  declared  an  official  Islamic  State  wilayat, 
or  province. 

Though  the  question  of  why  it  took  so  long  for  the  Islamic  State 
to  acknowledge  ISGS’s  bay  'a  has  percolated  in  various  outlets, 
three  factors  are  likely  at  play.  First,  the  newly  proven  capacity  of 
ISGS  to  carry  out  deadly  attacks,  as  highlighted  by  its  two  notable 
efforts  in  October  2016,  signaled  to  the  Islamic  State  that  ISGS  was 
more  than  just  a  nominal  fighting  force.  Second,  the  Islamic  State’s 
losses  of  land  in  Syria,  Iraq,  and  Libya  throughout  2016  have  high¬ 
lighted  its  vulnerabilities.  Yet,  because  of  its  concomitant  need  to 
appear  viable  and  expanding,  ISGS  was  likely  viewed  as  a  welcome 
addition  to  forward  that  illusion. 

Third,  the  Islamic  State’s  decision  to  recognize  ISGS  was  likely 
simultaneously  informed  by  the  disarray  plaguing  its  other  affili¬ 
ate  in  the  region,  the  Islamic  State  West  Africa  Province  (ISWAP), 
formerly  (and  to  a  degree,  currently)  known  as  Boko  Haram.  Since 
coming  under  the  leadership  of  Abubakr  Shekau  in  2009,  the 
group  had  always  been  aligned  with  al-Qa'ida.  Yet,  in  March  2015, 
Shekau  pledged  bay  'a  to  the  Islamic  State,  which  it  accepted,  trans¬ 
forming  Boko  Haram—  at  least  nominally— into  the  first  (and  still 
only)  sub-Saharan  African  Islamic  State  wilaya,  known  as  Wilayat 
West  Africa.  Yet  the  marriage  remained  fraught.  Shekau ’s  inter¬ 
pretation  of  takfirism,  or  the  justifications  by  which  Muslims  can 
rightly  be  attacked  in  the  orchestration  of  jihad,  conflicted  with  that 
of  Abu  Bakr  al-Baghdadi,  the  leader  of  the  Islamic  State.8  Moreover, 
Shekau’s  roguish  and  erratic  demeanor,  coupled  with  his  general 
insubordination  to  al-Baghdadi  also  caused  friction,  reciprocated 


g  Indeed,  although  al-Baghdadi  has  his  own  interpretation  of  takfirism 
and  has  justified  the  circumstances  under  which  Muslims  can  be  killed, 
Shekau’s  less  nuanced  vision,  which  broadly  fails  to  offer  a  clear  distinction 
between  Christian  and  Muslim  targets,  was  a  point  of  contention.  Freedom 
Ohuoha,  “Split  in  ISIS  Aligned  Boko  Haram  Group,”  Al  Jazeera  Centre  for 
Studies,  October  27, 2016. 
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when  at  least  eight  letters  that  Shekau  had  sent  to  al-Baghdadi  went 
unanswered.5 

In  light  of  these  tensions,  the  Islamic  State  announced  in  August 
2016  that  Shekau  had  been  replaced  by  Abu  Musab  al-Barnawi, 
believed  to  be  the  son  of  Boko  Haram’s  founder,  Mohammed  Yusuf. 
For  his  part,  Shekau  rejected  the  change  in  leadership,  asserting 
that  he  remained  in  charge  of  ISWAP/Boko  Haram.  Though  he  has 
remained  largely  silent  since  then,  Shekau  recently  resurfaced  in 
late  December  2016,  asserting  that,  contrary  to  statements  from 
the  Nigerian  government,  the  group  had  not  been  driven  from  its 
stronghold  in  the  Sambisa  Forest.6 

Presently,  ISWAP  has  two  factions:  the  al-Barnawi -led  faction 
that  controls  territory  in  the  Lake  Chad  Basin  area  in  northern  Bor- 
no  state  and  the  Shekau-led  faction,  which  controls  land  in  central 
and  southern  Borno  state,  including  in  the  group’s  historical  strong¬ 
hold  of  the  Sambisa  Forest.  Since  the  split,  though,  distinguishing 
in  a  refined  manner  the  nature  of  activities  between  the  two  factions 
remains  difficult.  What  is  clear,  though,  is  that  the  Islamic  State 
image  in  West  Africa  has  been  both  burnished  and  tarnished.  On 
one  hand,  it  has  shown  itself  capable  of  remaking  the  contours  of 
ISWAP  s  leadership.  On  the  other,  Shekau’s  rejection  of  the  change 
signals  that  the  Islamic  State  is,  in  fact,  not  entirely  omnipotent  in 
its  wilayat. 

And  yet,  despite  there  being  now  two  other  Islamic  State  affili¬ 
ates  in  the  same  broad,  though  not  exact  area  of  operation  as  ISGS, 
there  has  been  little  evidence  that  either  of  the  ISWAP  factions 
(Shekau’s  or  al-Barnawi’s)  has  actually  had  any  interaction  with 
the  Islamic  State’s  newest  faction  in  the  region,  ISGS.*1  Yet,  given 
that  cooperation  between  the  Islamic  State’s  wilayat  is  rare — except 
between  Iraq  and  Syria— the  lack  of  coordination  between  ISGS 
and  ISWAP  is  perhaps  unsurprising. 

The  Islamic  State  in  Somalia  (Abnaa  ul-Calipha) 

The  second  relatively  new  Islamic  State  affiliate  in  sub-Saharan 
Africa  is  known  as  the  Islamic  State  in  Somalia  (ISS).  The  group, 
which  emerged  in  2015  when  it  broke  away  from  al-Shabaab,  is 
led  by  Abdulqadir  Mumin.  Somali  by  birth,  Mumin  spent  years  in 
Sweden  and  the  United  Kingdom,  gaining  citizenship  in  the  latter, 
where  he  earned  a  reputation  as  an  extremist  cleric.  In  2010,  he 
returned  to  Somalia  to  fight  inside  al-Shabaab.  Once  in  Somalia, 
he  was  sent  to  the  relatively  remote  northern  Puntland  region — 
distanced  from  al-Shabaab’s  primary  area  of  operation,  much  fur¬ 
ther  south  near  Mogadishu— in  2012  to  attract  recruits.  When  his 
supervisor  there,  Mohamed  Said  Atom,  surrendered  to  the  Somali 
government  in  2014,  Mumin  took  control  of  the  al-Shabaab-affil- 
iated  outpost.7 

The  Mumin-initiated  defection  leading  to  ISS  began  when  the 
Islamic  State  launched  a  wide-ranging  social  media  campaign 
attempting  to  convince  al-Shabaab  to  switch  allegiances  from 
al-Qa'ida  to  the  Islamic  State,  making  overtures  to  form  Wilayat 
Somalia.8  Al-Shabaab  leaders  angrily  refused,  especially  given  that 
dissent  in  al-Shabaab’s  ranks  had  been  brewing  for  years— partic¬ 


h  Despite  Shekau’s  “ouster,”  even  his  offshoot  group  seems  not  to  have  fully 
renounced  its  allegiances  to  the  Islamic  State.  Given  that  both  he  and 
al-Barnawi  seem  to  be  in  broad  agreement  that  al-Baghdadi  is  the  caliph- 
even  after  the  split— this  indeed  signals  some  potential  for  reconciliation 
between  the  two  factions.  Freedom  Ohuoha,  “Split  in  ISIS-Aligned  Boko 
Haram  Group,”  Al  Jazeera  Centre  for  Studies,  October  27, 2016. 


ularly  in  2012  and  2013,  under  the  leadership  of  Ahmed  “Mukhtar 
Abu  al-Zubayr”  Godane9 — and  the  invitation  from  the  Islamic  State 
deepened  fissures.  In  September  2015,  Abu  Ubaidah,  the  leader  of 
al-Shabaab,  sent  out  an  internal  memo  stating  that  not  only  did  his 
group  reject  the  Islamic  State’s  overtures  and  pledged  to  remain 
loyal  to  al-Qa '  ida,  but  it  would  kill  its  own  members  and  members 
of  the  Islamic  State  if  they  promoted  the  split.' 

Back  in  Puntland,  and  serving  as  a  relatively  autonomous  al- 
Shabaab  commander  in  the  Galaga  mountains,  Mumin  began  to 
consider  himself  the  commander  of  a  separate  entity,  despite  hav¬ 
ing  no  battlefield  experience.  Feeling  physically  and  increasingly 
ideologically  distanced  from  al-Shabaab,  Mumin  pledged  bay  'a 
to  al-Baghdadi  and  the  Islamic  State  in  October  2015.  That  same 
month,  he  began  recruiting  soldiers  in  the  Galaga  hills  area,  espe¬ 
cially  among  members  of  villages  who  have  felt  aggrieved  by  the 
government  of  Puntland.  Though  interviews  with  early  defectors 
suggest  that  Mumin’s  pro- Islamic  State  contingent  originally  had 
as  few  as  20  followers,  it  is  now  believed  that  the  group  has  between 
100  and  200  fighters.  Importantly,  the  Islamic  State  has  not  offi¬ 
cially  acknowledged  Mumin’s  pledge  of  bay  'a,  nor  is  ISS  an  official 
wilaya.10 

Nevertheless,  operationally,  ISS  has  arguably  been  the  most 
powerful  of  the  new  Islamic  State  affiliates  in  sub-Saharan  Africa. 
On  October  26,  2016,  approximately  50  members  of  ISS  seized  the 
port  town  of  Qandala  in  the  Bari  region  of  Puntland,  making  the 
town  the  first  territory  the  Islamic  State  has  held  inside  Somalia. 
This  was  particularly  worrisome  as  Qandala  s  location  would  have 
given  the  group  port  access  on  the  Gulf  of  Aden  and  potentially 
afforded  it  proximity  to  linkages  with  Yemen.  As  of  late  Decem¬ 
ber  2016,  however,  Qandala  is  reported  to  have  completely  fallen 
to  Somali  maritime  forces.11  Regardless,  ISS’s  holding  of  the  town, 
even  for  a  short  time,  could  be  interpreted  as  an  important  symbolic 
victory  for  the  group. 

Beyond  simply  denying  the  Puntland  Islamic  State  affiliates 
physical  land,  security  forces  inside  Puntland  are  pushing  back.  A 
court  in  Puntland  sentenced  two  locals  to  death  for  suspected  links 
to  the  group  in  November  2016, 12  and  in  December  2016,  seven  of 
its  members  were  killed  by  Somali  forces  in  the  Bari  region.13  For  its 
part,  an  African  Union-led  meeting  of  security  chiefs  from  around 
East  Africa  in  early  December  2016  took  seriously  the  presence  of 
the  Islamic  State  in  Somalia,  noting  that  it  was  “aggressively  seeking 
to  establish  its  influence  ...  in  northeastern  Somalia.”14 

The  Islamic  State  in  Somalia,  Kenya,  Tanzania,  and 
Uganda  (Jahba  East  Africa) 

The  third  important,  and  even  newer,  Islamic  State-affiliated  group 
in  sub-Saharan  Africa  is  Jahba  East  Africa,  which  is  also  known  as 
the  Islamic  State  in  Somalia,  Kenya,  Tanzania,  and  Uganda  (ISIS- 
SKTU).  Like  the  Islamic  State  in  Somalia,  ISISSKTU  is  a  splinter 


i  For  its  part,  the  al-Shabaab  internal  security  service,  known  as  the  amniyat, 
has  been  known  to  arrest  its  members  who  sympathize  with  ISS.  Moreover, 
a  senior  official  of  al-Shabaab  in  the  Middle  Juba  region  of  Somalia,  who 
was  known  to  be  sympathetic  to  the  al-Shabaab/lslamic  State  merger, 
was  ambushed  and  killed  by  other  al-Shabaab  members.  See  Jason 
Warner,  “Choosing  Alliances,  Creating  Fissures:  How  the  Emergence  of 
ISIS  in  Africa  Affects  the  Relationships  Between  Boko  Haram,  Al-Shebab, 
and  Al-Qaeda,"  OE  Watch:  Foreign  News  &  Perspectives  of  the  Operational 
Environment  6:10  (2016):  pp.  54-56. 
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group  of  al-Shabaab.  Jahba  East  Africa  was  reportedly  initiated 
by  Mohamed  Abdi  Ali,15  a  medical  intern  from  Kenya  who,  along 
with  his  wife,  was  subsequently  arrested  in  May  2016  for  plotting 
to  spread  anthrax  in  Kenya  to  match  the  scale  of  destruction  of  the 
2013  Westgate  Mall  attacks.16  As  the  groups  name  suggests,  ISIS- 
SKTU  counts  among  its  ranks  citizens  from  the  aforementioned 
countries.  Thus,  given  that  the  group  is  composed  of  East  African 
citizens  who  had  previously  been  part  of  al-Shabaab,  ISISSKTU  is 
thought  to  contain  elements  of  al-Shabaab  that  were  once  described 
as  that  group’s  “foreign  fighters.”  Like  the  Islamic  State,  Jahba  East 
Africa  emerged  when  fighters  previously  loyal  to  al-Shabaab  sought 
to  realign  with  the  Islamic  State.  Jahba  East  Africa  pledged  bay  'a 
to  the  Islamic  State  on  April  8,  2016.17  To  date,  al-Baghdadi  has  not 
yet  accepted. 

Operationally,  Jahba  East  Africa  has  proven  to  be  more  of  an 
ideological  threat  than  a  physical  one.  Its  most  notable  attack  was 
on  a  convoy  from  the  African  Union  Mission  in  Somalia  (AMISOM) 
in  April  2016,  registering  as  the  first  time  that  an  Islamic  State  af¬ 
filiate  had  claimed  an  attack  in  Somalia.18  Beyond  this,  there  have 
been  scant  other  claims  of  violence.  Instead,  despite  the  attacks 
from  al-Shabaab,  Jahba  East  Africa  continues  to  take  a  hard  line 
against  its  former  parent  group,  issuing  statements  such  as  one  in 
July  2016  that  claimed: 

‘Al-Shabaab  has  become  stubborn,  arrogant  and  refuses  to 
accept  the  Khalif ah.  Today,  Al-Shabaab  ONLY  jails  and  kills 
innocent  Mujahideen  from  East  Africa.  Today,  Al-Shabaab  is 
weak,  and  everyday  Mujahideen  from  Kenya,  Tanzania  and 
Uganda  are  leaving  to  join  the  Khalifah.  Today,  Al-Shabaab 
is  in  GREAT  crisis.”19 

Finally,  before  proceeding  to  comparing  the  newly  created  affil¬ 
iates,  it  should  be  noted  that  al-Shabaab’s  leader  in  Kenya,  Ahmad 
Iman  Ali,20  also  pledged  bay  'a  to  the  Islamic  State  in  September 
2016,  though  an  acknowledgment  from  the  Islamic  State  has  not 
been  forthcoming.21  As  observers  have  noted,  it  is  unclear  if  this 
group  will  merge  with  one  of  the  other  pre-existing  Islamic  State 
affiliates  in  the  Horn  or  attempt  to  stake  its  claim  as  a  third  Islamic 
State-driven  center  of  power.  Thus,  counting  the  two  Boko  Haram/ 
Islamic  State  in  West  Africa  affiliates;  the  Islamic  State  in  Greater 
Sahara;  the  Islamic  State  in  Somalia;  the  Islamic  State  in  Somalia, 
Kenya,  Tanzania,  and  Uganda;  and  now,  the  Islamic  State  in  Kenya, 
sub-Saharan  Africa  now  boasts  at  least  six  pro-Islamic  State  groups, 
only  three  of  which  were  detailed  in  this  piece. 

Similarities  and  Differences  between  the  Affiliates 

How  then  do  these  three  newer  and  lesser-known  sub-Saharan  Af¬ 
rican  pro-Islamic  State  groups  compare  to  one  another?  All  three 
demonstrate  some  degree  of  commonality.  First,  each  emerged  as 
breakaway  groups  when  the  leadership  of  their  predecessor  groups 
decided  to  remain  loyal  to  al-Qa'ida.  Moreover,  all  three  groups 
emerged  around  the  same  time,  in  mid-2015,  just  as  the  Islamic 
State  was  exhibiting  the  height  of  its  power.  Third,  none  of  the 
groups  are  particularly  large,  nor  are  they  very  well-understood. 

Yet,  there  are  indeed  notable  differences  between  the  three  Sa¬ 
haran  and  sub-Saharan  African  Islamic  State  affiliates.  For  one,  the 
Islamic  State  in  the  Greater  Sahara  might  be  thought  to  be  slightly 
more  institutionalized  than  those  Islamic  State  affiliates  in  the  East 
African  region.  This  is  the  case  for  two  reasons.  First,  it  is  the  only 
one  of  the  “new”  Islamic  State  affiliates  whose  bay  'a  to  the  Islamic 
State  has  actually  been  acknowledged.  Second,  ISGS  is  the  only  one 


of  these  groups  to  have  carried  out  multiple  attacks.  It  is  import¬ 
ant  to  recall,  however,  that  the  Islamic  State  in  Somalia  is  the  only 
group  to  have  held  occupied  (i.e.  not  desert)  territory  in  the  form 
of  the  town  of  Qandala— even  though,  as  of  this  writing,  it  does  not 
currently  hold  it— a  fact  that  might  encourage  the  Islamic  State  to 
accept  its  bay  'a  soon. 

Conclusion 

What  does  the  current  operational  environment  suggest  for  the  fu¬ 
ture  of  these  new  Islamic  State-affiliated  groups  in  Africa?  While 
speculative,  it  could  be  argued  that  as  the  Islamic  State’s  fortunes 
decline— with  the  likely  fall  of  Mosul  in  2017  and  impending  attack 
on  the  Islamic  State’s  Syrian  stronghold  of  Raqqa — so  too  might 
these  groups’  loyalty  to  the  Islamic  State.  Two  options  exist:  if  the 
Islamic  State’s  global  fortunes  decline  significantly,  the  three  afore¬ 
mentioned  groups  could  just  as  easily  reestablish  an  al-Qa'ida  al¬ 
legiance,  or  members  could  reintegrate  themselves  back  into  the 
“parent”  group,  theoretically  leading  to  a  contraction  in  the  num¬ 
ber  of  Islamist  insurgencies  on  the  continent.  On  the  upside,  given 
the  small  number  of  fighters  in  each  of  the  three  pro-Islamic  State 
groups  under  discussion,  there  is  seemingly  little  room  to  splinter 
further,  unlike  the  much  larger  al-Qa'ida-affiliated  groups  that 
gave  birth  to  them. 

In  light  of  this,  what  should  we  expect  to  be  the  nature  of  inter¬ 
action  between  Islamic  State-affiliated  groups  and  al-Qa '  ida-affil- 
iated  groups  on  the  ground?  Answers  are  mixed  depending  on  the 
region.  In  the  Horn,  more  conflict  between  Islamic  State-affiliated 
groups  and  al-Qa '  ida-affiliated  groups  seems  likely.  First,  al-Qa- 
'  ida-affiliated  al-Shabaab  is  already  known  to  have  attacked  and 
killed  many  of  its  pro-Islamic  State  defectors.  Second,  it  is  not  at  all 
likely  that  al-Shabaab  leadership  will  soon  reverse  course  to  support 
the  Islamic  State’s  overtures.  Conversely,  in  the  Sahara  and  Sahel, 
antagonism  between  ISGS  and  other  al-Qa '  ida-affiliated  groups  in 
the  Sahara  and  Sahel  seems  somewhat  less  likely  given  that  there 
appears  to  be  little  bad  blood  between  Sahouri’s  ISGS  and  its  parent 
group,  Belmokhtar’s  al-Qa'ida-affiliated  al-Mourabitoun.  More¬ 
over,  some  analysts  have  interpreted  the  openness  of  Yahya  Abu 
el  Hamman  Okacaha,  the  leader  of  al-Qa '  ida’s  Sahara  branch,  to¬ 
ward  maintaining  open  lines  of  communication  with  Saharoui  as 
evidence  of  potential  cooperation  between  the  two  groups.22  More 
broadly,  as  former  C.I.A.  Director  John  Brennan  has  suggested,  it 
is  potentially  the  case  that  the  further  afield  groups  move  from  the 
“heartland”  of  Syria  and  Iraq,  the  more  likely  that  collaboration 
between  Islamic  State-affiliated  groups  and  al-Qa'ida-affiliated 
groups  might  be.23 

Finally,  it  is  important  to  remember  that  despite  the  outcropping 
of  these  three  “new”  Islamic  State-affiliated  groups,  none  really  ri¬ 
vals  the  major  al-Qa'ida- aligned  affiliates  on  the  continent,  which 
dominate  in  terms  of  number  of  groups,  number  of  adherents  per 
group,  and  length  of  time  in  operational  area.  Nor  do  such  groups 
present  any  real  challenges  to  either  of  the  Islamic  State-aligned 
Boko  Haram  factions.  Nevertheless,  with  the  uncertain  future  of 
the  Islamic  State  globally,  observers  should  stay  vigilant  about  the 
current  and  future  activities  of  these  three  new  Islamic  State  affili¬ 
ates,  whose  presence  and  activities  seems  likely  to  grow,  at  least  in 
the  short  term.  CTC 
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